On the evening of July 10, Progress Software emailed ShareFile customers using Storage Zone Controllers with the subject line "Service Disruption" and a clear instruction: shut down the Windows servers hosting those systems immediately. The company said it had identified a credible external security threat targeting the on-premises controller, had already disabled cloud-side access to affected accounts, and was working with internal and external cybersecurity experts to investigate. Progress explicitly told customers that manually powering down the physical server was a critical additional step beyond the cloud-side block, which suggested the threat could be triggered or persisted even without active cloud connectivity. Progress has not disclosed whether a zero-day vulnerability is involved, whether any Storage Zone Controllers have been compromised, or when customers can safely restart. As of the weekend, the ShareFile status page listed Storage Zone Controller customers as not operational with the investigation still ongoing. Standard cloud-only ShareFile accounts are not affected.

On July 6, threat actor 888 posted a listing on a cybercrime forum claiming to sell 35 gigabytes of data stolen from Accenture in July 2026. The claimed dataset includes source code, RSA keys, SSH keys, Azure Personal Access Tokens, Azure Storage access keys, and configuration files. As supporting evidence, 888 posted a screenshot showing the cloning of an Azure DevOps repository named 121123_AtriasTalentAcademy hosted on an Accenture production domain. Accenture confirmed the incident to multiple outlets on July 7, describing it as an isolated matter that had been remediated at the source, with no impact on operations or service delivery. The company did not confirm or deny the 35-gigabyte figure, the credential types claimed, or whether any client data was involved. The initial access vector has not been disclosed. Researchers noted the presence of .env file references in the sample, which suggested the data may have originated from a developer machine rather than a repository, since .env files are typically excluded from repository uploads.

Zimbra published an urgent security notice on July 11 describing a stored cross-site scripting vulnerability in the Classic Web Client. A stored XSS flaw means the malicious payload is embedded in content that the server stores and later delivers to users, in this case inside an email. When a recipient opens a message containing the crafted payload, the embedded JavaScript executes inside their authenticated browser session. Zimbra's advisory states that successful exploitation could allow access to mailbox information, session data, and account settings. The broader consequence of session-based JavaScript execution extends to session token theft, which would allow an attacker to hijack the session entirely without needing the user's password. No CVE has been assigned, and no technical details of the payload mechanism have been published. Zimbra is urging all customers running the Classic Web Client to apply the available update immediately.