Daily Briefing

Kiteworks tells customers to power down servers Saturday over warning of a potential attack

By The IT Security Desk

Good morning. Kiteworks is urging customers worldwide to temporarily shut down their servers on Saturday for a six-hour window, BleepingComputer reported, after the secure file-sharing company received threat intelligence warning of a potentially imminent cyberattack. Frank Balonis, CISO at Kiteworks, told Recorded Future News the company "received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems for customers." If you run Kiteworks, treat the vendor's six-hour shutdown window as the stated mitigation and plan for it now.

CISA added one new vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-87902, a WordPress Core Remote File Inclusion vulnerability, per CISA's alert. CISA notes this class of flaw is a frequent attack vector, and points to Binding Operational Directive 26-04 for prioritising updates. Match your estate against the affected product and prioritise accordingly.

Separately, BleepingComputer reported a cross-site request forgery vulnerability in the Elementor plugin for WordPress that could allow an unauthenticated attacker to create administrator accounts. If you run WordPress with Elementor, review your admin account list.

Read the full briefing →