Company
Secure content and communications vendor providing data governance, compliance, and secure file-sharing tools, formerly known as Accellion.
Kiteworks fixed CVE-2026-54154, a CVSS 10.0 flaw letting unauthenticated attackers run code on its Email Protection Gateway, in version 9.4.1. Other EPG flaws disclosed the same day are fixed only in 9.5.1, so internet-facing gateways should go straight to that release.
Reality
Coding agents put 13,000 screenshots from 343 tech companies into public GitHub repos when private pull requests would not show them. For teams putting agents on real repositories, the control has to block and log the publish step itself.
Reality
Members of Congress have introduced at least three bills since late July to keep AI systems under human shutdown control. The duty sits with model developers, while a switch-off would disrupt the companies whose workflows run on those models.
Reality
Kiteworks lifted its worldwide shutdown advice after patching a critical flaw in a feature used by under 1% of customers. Self-hosted operators stopped and restarted on the vendor's word alone, with no CVE yet to check the fix against.
Perspective Coverage
5 publishersReality
Kiteworks told all customers to shut down for about nine hours after federal intelligence said a threat actor might target certain of its systems. Self-hosted Advanced Forms users also need Kiteworks support to confirm the fix, beyond version 9.5.1, before restarting that feature.
Reality
Kiteworks lifted its shutdown advice on Sunday and sent customers running self-hosted Advanced Forms, enabled at under 50 organisations, to support. The flaw has been described only in private customer emails, so those operators are handling it case by case with the vendor.
Reality
Kiteworks told customers to shut its file-transfer servers for nine hours this weekend after a federal warning. The company says its current release fixes every known flaw, so the outage guards against one it does not know about.
Perspective Coverage
3 publishersReality
Kiteworks told customers worldwide to power off its file-sharing servers for six hours on September 26 after a federal warning of a possible attack. Servers with no internet exposure are included, so being on release 9.5.1 with every known fix does not by itself clear a customer.
Perspective Coverage
5 publishersReality
Kiteworks has told customers to shut down servers over a possible attack, and Heise reports a six-hour worldwide window starting Saturday. Its 9.5.1 update fixes only known flaws, so self-hosted operators are weighing downtime against a threat the company has not described.
Reality
Kiteworks paid an undisclosed sum for Bonfy.AI to apply policy at the moment of exchange, its eighth acquisition in under five years, and the case for going beyond at-rest inventories comes from the buyer itself.
Reality
Kiteworks' eighth acquisition in under five years puts policy decisions inline on email, file shares and agent traffic. The price is undisclosed, and CTech estimates tens of millions for a startup 15 months out of stealth.
Reality
SecurityWeek logged 33 cybersecurity acquisitions in August 2026. Two of them took technology assets out of small vendors instead of buying the vendors, and only Kiteworks' move into Japan promised customers unchanged contracts and pricing.
Reality
Kiteworks found 96% of defense contractors trust their self-attested SPRS score and 29% can substantiate it. The DFARS duty to attest accurately never stopped when the third-party audits did.
Reality