In 30 seconds
- When a vendor tells you to shut down your servers within six hours, the risk is not theoretical. Kiteworks has issued an emergency advisory over a potential zero-day affecting its managed file transfer platform, and the guidance is blunt: take it offline until you can confirm you are safe.
- CISA added two more exploited vulnerabilities to the KEV catalogue on 25 September, including SharePoint, WSO2, and Adobe Commerce flaws. Exploitation is confirmed, not predicted. If these products are in your estate, the remediation clock is already running.
- A critical WordPress flaw is now being actively exploited for remote code execution. If your organisation or any of your suppliers run WordPress, this is a patch-now item, not a next-sprint item.
Why it matters
This week is about emergency response speed. Not the kind you write about in a policy document. The kind where a vendor phones you on a Thursday afternoon and says "shut it down", and you need to know whether you can, who approves it, and what breaks when you do.
Kiteworks: when "shut it down" is the vendor's actual advice
Kiteworks is a managed file transfer platform used by regulated organisations to move sensitive data securely. When the vendor itself tells customers to take servers offline within six hours over a potential zero-day, that is not an overreaction. It is a signal that the risk is severe enough to justify operational disruption.
For Channel Islands firms, the question is not just "do we run Kiteworks?". It is "do any of our suppliers, counterparties, or fund administrators use it to move our data?". Managed file transfer platforms sit directly in the path of sensitive client information, regulatory filings, and financial data. A compromise here is not a single-system problem. It is a data exposure and regulatory reporting problem.
If Kiteworks is anywhere in your supply chain, confirm the status with the relevant party. If it is in your own environment, follow the vendor guidance immediately and document what you did and when. The organisations that come out of these events cleanly are the ones that can show a timeline of action, not a timeline of delay.
CISA KEV: two more confirmed exploitations
CISA added two more vulnerabilities to the Known Exploited Vulnerabilities catalogue on 25 September, covering SharePoint, WSO2, and Adobe Commerce. For those less familiar, CISA is the US Cybersecurity and Infrastructure Security Agency, and their KEV catalogue is a public register of software flaws confirmed to be actively exploited in the wild. Every entry means someone, somewhere, is already using that vulnerability to break into organisations. The reason it matters outside the US is simple: attackers do not respect borders.
SharePoint keeps appearing in KEV for a reason. It is widely deployed, often internet-facing, and frequently under-patched in on-premises environments. If you are still running on-prem SharePoint, this is another week where you need to confirm patch status and exposure. WSO2 and Adobe Commerce may be less common in Channel Islands estates, but they can sit in supplier environments or third-party portals. Check your supplier inventory.
WordPress: the supply chain you forgot about
WordPress powers a significant portion of the web, including marketing sites, client portals, and supplier-hosted services. A critical flaw is now being actively exploited for remote code execution. That means attackers can run their own code on affected servers, which is about as bad as it gets.
The risk for regulated firms is often indirect. You may not run WordPress yourself, but your marketing agency, your recruitment portal, or a supplier's client-facing site might. A compromised WordPress site can be used for credential harvesting, malware distribution, or as a stepping stone into connected systems. Confirm whether WordPress exists anywhere in your ecosystem, patch immediately if it does, and if a third party manages it, get written confirmation of their patch status this week.
Questions to ask your team this week
- 1.Do we run Kiteworks anywhere, or do any of our suppliers use it to transfer our data, and have we confirmed their response to the vendor advisory?
- 2.For this week's two KEV additions, can we confirm whether the affected products exist in our estate and show evidence of patching or mitigation?
- 3.If a vendor told us to take a critical system offline within six hours, do we have an approved emergency change process that can move that fast, including out-of-hours?
- 4.Which WordPress sites exist in our ecosystem, including supplier-managed ones, and who is accountable for patching them?
One thing to do this week
Run a 60-minute "emergency shutdown readiness" drill. Pick one critical system and walk through the scenario: the vendor says take it offline now. Who approves? What is the business workaround? How do you communicate to affected users and clients? How quickly can you prove what you did? Capture the gaps and fix the process before you need it for real.
Sources
- BleepingComputer, "Kiteworks urges 6-hour server shutdown over potential zero-day attacks" (25 September 2026):
bleepingcomputer.com - CISA, "CISA Warns of SharePoint, WSO2, Adobe Commerce Flaws Exploited in Attacks" (25 September 2026):
bleepingcomputer.com - BleepingComputer, "Hackers start exploiting critical WordPress flaw for code execution" (25 September 2026):
bleepingcomputer.com - CISA, Known Exploited Vulnerabilities Catalog:
cisa.gov