Tech News, September 27: Kiteworks’ Weekend Shutdown, ShinyHunters Hits PeopleSoft Again, and Copilot Gets the Full Office

A secure file-transfer vendor told its customers to unplug their servers for the weekend, a hacking group went back to a patched-but-not-quite vulnerability in Oracle software, and Microsoft decided the document is no longer the entry point — the AI is. Here is what happened in the last day, with the numbers that matter.

Kiteworks tells customers to shut down systems over possible zero-day

On September 25, Kiteworks — the secure managed file transfer (MFT) vendor formerly known as Accellion — warned customers to shut down their MFT servers over the weekend after receiving what it describes as credible intelligence about an imminent attack. German outlet Heise first reported the advisory from a customer email; the company then published a formal press release on September 26 confirming it.

The details are unusual. According to Kiteworks chief information security officer Frank Balonis, the company “received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems,” and the shutdown was ordered “out of an abundance of caution.” Balonis said he was unaware of any compromise. No CVE has been assigned, no technical details about the flaw have been published, and the company’s release states that all known vulnerabilities are addressed in the current version, 9.5.1.

There is a discrepancy in the reported shutdown window: Heise, citing the customer email, described a six-hour period on Saturday, September 26 (3am to 9am UK time); the company’s formal advisory asks for a nine-hour precautionary shutdown in each customer’s local time zone over the weekend. Customers who self-manage their systems — on-premises, on AWS, or on Azure — must shut them down themselves; Kiteworks shuts down hosted systems for those customers, and lists eight subsidiaries (including Zivver, DRACOON, totemo, and ownCloud) as unaffected.

Advisory timeline

Why it matters: a vendor asking its entire customer base to unplug production systems without a patch, a CVE, or any technical detail is almost unheard of. “Nobody requests that their entire customer base to unplug production systems over the weekend because of a hunch,” said Jake Knott, head of threat intelligence at Watchtowr, quoted by Computer Weekly. The pattern behind the warning is one of intent rather than disclosure: intelligence suggesting an exploit will be used before any fix exists. File-transfer appliances are repeat targets for exactly this reason — one appliance can cascade into dozens of downstream organizations, as previous campaigns against MOVEit, GoAnywhere, and Accellion’s own file transfer product demonstrated.

ShinyHunters resumes mass exploitation of Oracle PeopleSoft

Google’s cybersecurity division reported on September 26 that the hacking group ShinyHunters has resumed “mass exploitation” of a vulnerability in Oracle’s PeopleSoft enterprise software, according to a Mandiant threat intelligence report. The group had attacked PeopleSoft systems from May 27 to June 9, 2026; after that campaign, organizations put up web application firewall (WAF) defenses. Mandiant says the hackers adapted to the defensive guidance and this time targeted organizations that implemented WAF rules but never applied the security update Oracle issued.

The resumed attacks hit dozens of systems globally across six sectors: higher education, technology, healthcare, agriculture, government, and transportation. ShinyHunters has also claimed it accessed the FBI through the same PeopleSoft vulnerability, saying it exposed the names of personnel in sensitive units and obtained medical and psychiatric records — claims the FBI is “aggressively investigating,” per the reporting. Those FBI-related claims are the group’s own assertions and have not been independently confirmed.

The two waves

Why it matters: this is the oldest failure mode in enterprise security playing out again — the patch existed, but a compensating control was treated as a replacement for it. WAF rules filter known attack patterns; they do not fix the underlying flaw, and attackers who study the defense can shape their traffic around it. PeopleSoft sits on top of HR, payroll, and financial records, so “dozens of systems” understates the sensitivity. If you run PeopleSoft and patched only with a WAF, the advice from this report is unambiguous: apply Oracle’s update.

Microsoft folds Word, Excel, and PowerPoint into Copilot

Microsoft unveiled on Friday, September 25, a new direction for its productivity suite: Copilot becomes the front door to Office. In the coming weeks, individual Microsoft 365 subscribers and businesses in the company’s testing program will be able to create, edit, and share Word, Excel, and PowerPoint files inside Copilot without switching applications, AFP reported.

“Many people have put simplified document viewers into their products over the course of the last year. But this is full-blown Office,” said Jacob Andreou, the executive vice president in charge of Copilot. The move lands alongside Autopilot — previously called Scout — which Microsoft described in June as its first “always-on” AI assistant, able to run online even when the user’s computer is off. Autopilot remains limited to a handful of clients. CEO Satya Nadella on Wednesday compared the arrival of these workplace AI tools to the advent of the personal computer, when email with an Excel attachment gradually replaced the typed internal memo sent by fax.

What changes

Why it matters: OpenAI and Anthropic each shipped their own document-creation tools in recent months, and Microsoft — which runs Copilot primarily on those two labs’ models — is now racing to make its own assistant the place where documents happen. The deeper play is the workflow flip: instead of opening an app to make a document, you ask the assistant, and the app becomes an interchangeable rendering target. For developers, the adjacent story is the agentic one — an always-on assistant that acts continuously is a new trust boundary in workplace software, and Microsoft is deploying it one cautious customer group at a time.

For how Copilot compares with the other leading AI coding tools, see our comparison of GitHub Copilot, Cursor, and Claude Code.

Google tests buying from Flipkart through Gemini and AI Mode in India

Google is testing shopping inside its AI surfaces in India: select users can buy products from Walmart-owned Flipkart through Gemini and AI Mode, TechCrunch reported on September 26. The test is limited to select products and users, with a broader rollout planned for later in October.

Why it matters: this is agentic commerce in its earliest public form — the assistant moving from answering product questions to handling the transaction. India is a deliberate proving ground: a huge Android and UPI-shopping population, and a market where Google already fights for AI relevance against fast-moving local competitors. If the test survives to a broader October rollout, expect the model — AI assistant as checkout lane — to show up in Google’s other shopping markets next.

Key takeaways

• Kiteworks’ weekend shutdown is the story of the day: a credible-threat warning with no CVE and no patch, a nine-hour shutdown window, and all known flaws said to be fixed in release 9.5.1. If you self-manage a Kiteworks system, the advisory is your weekend.
• WAF rules are not a patch. ShinyHunters’ resumed PeopleSoft campaign specifically targeted organizations that added firewall defenses but skipped Oracle’s update — dozens of systems across six sectors were hit.
• Copilot is absorbing Office: full Word, Excel, and PowerPoint creation and editing inside the assistant rolls out in the coming weeks, with always-on Autopilot agents trailing behind for a small client group.
• Google is testing agentic checkout: select Indian users can buy from Flipkart through Gemini and AI Mode, with a wider rollout expected in October.

References

• Computer Weekly: Expecting cyber attack, Kiteworks tells users to turn off servers
• Kiteworks press release: Precautionary shutdown advisory for customers following credible threat intelligence
• CosmicBytez Labs: Kiteworks urges server shutdown over potential zero-day attacks
• Times Now: ShinyHunters resume mass exploitation of Oracle PeopleSoft vulnerability, Google says
• Malay Mail (AFP): Microsoft integrates Word, Excel deeper into Copilot
• SaveDelete / TechCrunch: Google tests buying from Flipkart through Gemini and AI Mode in India