ShareFile Emergency Shutdown, The Gentlemen Ransomware, Ghostcommit AI Agent Attack, Zimbra TAG XSS

The defining story is the emergency shutdown Progress Software forced on ShareFile Storage Zone Controllers. Progress ShareFile Storage Zone Controllers, Credible External Security Threat Forces Emergency Shutdown told customers to power down the Windows servers hosting the controllers and disabled cloud access, saying disabling access through the platform is not enough. No patches exist, no compromise is confirmed, and the parallel to the 2023 MOVEit mass theft is unavoidable: these controllers are internet-accessible, handle sensitive file transfers, and sit between vendor cloud and customer storage. Treat every controller as a liability until the investigation resolves.

The ransomware economy is consolidating around The Gentlemen Ransomware (Storm-2697), Fastest-Growing RaaS of 2026 With 580 Victims Across 77 Countries. The program, formerly the ArmCorp affiliate of Qilin, claims 580 victims with manufacturing most targeted, pays affiliates an unprecedented 90 percent cut, ships C and Go variants covering ESXi, and fields a custom EDR-killer framework. June alone saw nearly 4x January's victim count.

AI code agents are a growing exfiltration channel. Ghostcommit hides instructions inside PNG images that AI code reviewers never open, then steals repository secrets through coding agents, and the researchers showed the flaw is in the tooling rather than the model. The FlowiseAI CSV Agent RCE now has a Metasploit module, and the GitHub ghost-account campaign maps organizations through dormant profiles.

Watchlist: shut down or isolate Storage Zone Controllers, hunt Gentlemen indicators including gentlemen-named scheduled tasks, restrict ESXi management VLANs, and review what AI code agents may read and execute.