decrypted · 11 july 2026 · vulnerabilities and patching · supply chain

The ShareFile shutdown, and the bypass that made it necessary

Progress Software spent Friday night telling ShareFile customers to physically power off their servers, not just log out of them. The instruction arrived without a CVE, without confirmation of a breach, and without much detail beyond a "credible external security threat", but the shape of it was familiar to anyone who remembers 2023: another Progress product, another enterprise file-transfer platform, another emergency notice. This week's Decrypted looks at what the ShareFile scramble says about trusting an admin interface, then rounds up a ransomware claim against a Yorkshire SME lender, a live prompt-injection campaign against AI browsing agents, and a fast-moving supply-chain attack on fake payment SDKs.

The order: switch it off at the wall

On 10 July, Progress emailed customers running ShareFile's on-premises Storage Zone Controllers and told them, in effect, to pull the plug. Disabling cloud access was "not enough", the email said; customers had to manually shut down the Windows server hosting the controller. Progress said it had no evidence of unauthorised access to accounts or data, gave no CVE, and promised an update within 24 hours. BleepingComputer and Cyber Security News both reported the notice within hours of it landing, and both drew the same comparison: this looks like the run-up to a MOVEit-style event, the Progress product that Clop turned into 2023's biggest breach story.

The bypass that was already public

Nobody needed to wait for a CVE to be worried, because two already existed. In April 2026, watchTowr Labs disclosed CVE-2026-2699, an authentication bypass in Storage Zone Controller rated 9.8, which could be chained with CVE-2026-2701, a remote code execution flaw rated 9.1, to let an unauthenticated attacker reach a restricted configuration page and upload a malicious webshell. Shadowserver counted roughly 784 internet-exposed instances at the time. Three months on, an unpatched, internet-facing admin surface with a known pre-auth bypass is exactly the kind of target that turns a quiet vulnerability report into a Friday-night shutdown order.

Secure by Design: the admin plane is not a feature

The lesson here is not simply "patch faster", though that helps. It is that a configuration interface for a file-transfer appliance had no business being reachable by an unauthenticated user on the open internet at all. Secure by Design asks vendors to make the safe configuration the only configuration: administrative interfaces closed to the internet by default, strong authentication before any page renders, and enough separation that one bypass cannot cascade straight into code execution. It is also worth noting that Progress itself needed customers to physically power down hardware to be confident its control plane was closed, a reminder that revoking an account is not the same as closing an exposure. UK organisations running any on-premises file-transfer product should treat internet-facing admin panels as a standing liability rather than a convenience, and check today whether Storage Zone Controllers are among them.

Also this week

A Yorkshire lender on a leak site, and the numbers behind it. Finance Yorkshire, which funds SMEs across the region, was listed on 9 July by the CMD Organization ransomware group. Decrypted has not independently verified this claim and treats it as such. It lands days after City of London Police reported 323 UK ransomware victims between April 2025 and March 2026, more than half of them SMEs, with average losses up 50% to around £270,000. The advice from Chief Superintendent Amanda Wolf, on backups, access control, patching and following NCSC guidance, is unglamorous. It is also correct, and remains the cheapest insurance most small firms never buy.

AI agents paying the wrong invoice. Zscaler's ThreatLabz documented two live campaigns using indirect prompt injection: one hid instructions in fake documentation for a Python library, telling coding agents to pay a "licence fee" to an attacker's crypto wallet, the other typosquatted the DeFi tracker DeBank and told agents to treat it as authoritative. Across 26 tested models, four, including versions of Llama and Gemini, made the payment. Any UK business letting an agent browse and act unsupervised is trusting every page it reads as much as its own instructions, which is precisely the design flaw.

Payment SDKs that weren't. Seventeen npm packages and four PyPI packages impersonating Paysafe, Skrill and Neteller SDKs appeared on 7 July and were pulled within minutes, but not before harvesting environment variables containing API keys, AWS credentials and GitHub tokens from anyone who installed them. The fix is boring but effective: pause automatic dependency updates, review new packages before pulling them, and keep publishing credentials off developer workstations.

Sources