Kiteworks urges precautionary shutdown after federal threat alert

Kiteworks warned customers to take a 9-hour preventive shutdown window this weekend after receiving credible threat information from federal intelligence authorities. The company said there is no sign of compromise, and all known vulnerabilities are addressed in version 9.5.1.

Why it matters: - Kiteworks is asking customers to take systems offline briefly to reduce risk after a federal threat warning. - The company says the move is preventive, not a response to a confirmed breach. - The guidance affects organizations running their own Kiteworks deployments, including on-premises systems and self-managed instances on AWS or Azure.

What happened: - Kiteworks said it received credible threat intelligence from federal information authorities about a threat actor that could target some Kiteworks systems. - The company issued a customer advisory on Sept. 25, 2026, from San Mateo, California. - Customers are being asked to plan for a 9-hour preventive shutdown window this weekend in their local time zones. - Customers hosting Kiteworks themselves on-premises or in AWS or Azure should shut down their systems during that window. - Customers using Kiteworks-hosted systems do not need to take action because Kiteworks will shut those systems down during the same window. - Kiteworks said it has not seen signs that its own systems or customer systems were compromised.

The details: - Frank Baronius, Kiteworks' chief information security officer, said the company notified customers directly and recommended the shutdown out of caution. - Kiteworks said it continues to work with federal information authorities on the issue. - The company said version 9.5.1 addresses all known vulnerabilities. - Kiteworks said it continues to recommend that customers use the latest version. - The advisory was sent by email to all customers with the specific timing and recommended 9-hour window. - Customer support guidance was provided through email, a community portal, a support website, and regional phone numbers. - Contact options include the community portal and Kiteworks support.

Between the lines: - The advisory signals a defense-in-depth move meant to narrow exposure before a potential attack, even without evidence of compromise. - By separating hosted and self-managed customers, Kiteworks is limiting disruption where it can control the environment directly. - The company also noted that the threat does not affect its other subsidiaries, including Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, and 123FormBuilder.

What's next: - Customers running their own environments are expected to follow the shutdown guidance during the 9-hour window. - Kiteworks said it will keep working with federal authorities as the situation develops. - Customers seeking help are being directed to Kiteworks technical support for environment-specific questions.

The bottom line: - Kiteworks is treating the threat as credible enough to disrupt service briefly, but says the move is precautionary and no breach has been found.