"You can expect to hear from us in the next 24 hours," Progress Software wrote on July 10 about a developing security issue affecting its ShareFile customers.
Progress ShareFile Storage Zone Controllers: the target and its role
Progress Software alerted some ShareFile customers on July 10 that it was aware of "a credible external security threat targeting Progress ShareFile Storage Zone Controllers." The Storage Zone Controller is the component that provides ShareFile customers with private data storage; the advisory framed the controller as the locus of the reported threat.
Customer advisory and immediate actions: account access disabled, servers asked shut down
In the company-issued email — which a ShareFile user posted to Progress’s official ShareFile Community forum — Progress said there was "no evidence of unauthorized access to ShareFile accounts or data" but confirmed that it had temporarily disabled access to affected accounts. The advisory also urged users to manually shut down the server hosting their Storage Zone Controller.
Investigations and available evidence: internal and external probes, but no public details
Progress said it has launched both internal and external security investigations to assess the potential threat. The company did not provide any detail about the evidence that led to the threat detection, nor did it set a public timeline for when the disruption would be resolved. Progress’s July 10 message promised follow-up within 24 hours, but the company has not publicly supplied a detailed update since that notice.
Community response: forum post, Reddit reports, and status-portal consistency
The initial company message reached wider users after being posted by a ShareFile customer on Progress’s official community forum in response to another user reporting service disruptions. Several ShareFile users on Reddit reported on July 13 that Progress had not provided any updates for the previous three days; this absence of new posts appears consistent with the ShareFile status portal, which shows its most recent update dated July 10.
Links to past incidents and unconfirmed vulnerability theories
Forum participants and some commentators have speculated the incident could be connected to exploitation of recently disclosed vulnerabilities or to a previously unknown zero-day. Progress has not confirmed those claims. The advisory and community discussion followed a history of related product security problems: Progress experienced a 2023 breach of its MOVEit Transfer product, which the company said was exploited in widespread ransomware attacks, and a critical vulnerability in MOVEit Automation was reported in April 2026 and caused further disruptions. The company has not linked the current Storage Zone Controller advisory to those prior events in its public message.
What this means for technologists, enterprises, and end users
- Technologists and security teams: Progress specifically advised customers to manually shut down the server hosting their Storage Zone Controller; security and operations teams will be monitoring Progress’s investigations and the ShareFile status portal for technical guidance and timeline details.
- Enterprises and procurement leaders: With access to certain ShareFile accounts temporarily disabled, organizations that rely on ShareFile private storage will be assessing operational impacts and awaiting Progress’s forensic findings to determine recovery and contractual implications.
- End users and administrators: Users experiencing service disruptions have sought updates on public forums and Reddit; absent new information from Progress since July 10, administrators will need to track official channels and community reports for restoration notices.
Progress says it is investigating and promised a follow-up within 24 hours of its July 10 advisory; as of July 13 that follow-up had not been posted publicly and Infosecurity has contacted Progress Software for comment. The core facts remain narrow and concrete: Progress identified a credible external threat aimed at ShareFile Storage Zone Controllers, temporarily disabled account access, asked customers to shut down affected servers, and opened internal and external investigations. Whether the incident will be tied to specific vulnerabilities — disclosed or zero-day — or traced to other causes remains unanswered until Progress releases further detail.
https://www.infosecurity-magazine.com/news/progress-warns-security-threat/
