Update: how the PowerFolder Cloud restart works — security update for PowerFolder Server

• PowerFolder Cloud: the restart is planned for Tuesday, 10 November 2026. All systems are being rebuilt; all credentials and keys have been replaced.
• PowerFolder Server (self-hosted): a security update is in final testing and is expected on Monday, 9 November 2026. Please install it as soon as it is available.
• Until then: block all requests to /wopi/ at your reverse proxy or firewall — also for your document server. Disabling online editing in the settings does not protect you. If in doubt, take the server offline.

How the restart works

1. Monday, 9 November — final tests of the security update on our test systems.
2. Tuesday, 10 November, morning — the rebuilt cloud systems start, first internally with checks of all functions.
3. Tuesday, 10 November, during the day — release for all customers: drive.powerfolder.com, my.powerfolder.com and the hosted customer systems, one after another.
4. At your first sign-in you set a new password; desktop clients and apps sign in once again. Your files and shares are unchanged; synchronisation then continues automatically.
5. From the restart we monitor all systems with increased attention for 72 hours.
6. Monday, 9 November, expected — security update for PowerFolder Server available for download; operators are also informed directly.

Your old password no longer works. We have reset every password for the restart. Even if the attacker did manage to recover something from the passwords we store in protected form, it can no longer be used to get in. That is why you set a new password at your first sign-in.

You will find the current status here.

What we have done since the last update

We have analysed all logs and put our code through a comprehensive security review. The security update closes the exploited vulnerability and further weaknesses we found. We will publish details only once operators have had time to update. Our development and test systems have been secured as well.

What needs to be done

• At your first sign-in after the restart you set a new password — there is no way past it; all devices sign in once again.
• Do not use your PowerFolder password anywhere else. If you did, change it there.
• Be careful with emails claiming to be from PowerFolder. We never ask for your password.
• PowerFolder Server operators: install the update as soon as it is available; keep /wopi/ blocked until then.

Authorities: we have informed the German Federal Office for Information Security (BSI), notified the data protection authority and filed a criminal complaint.

Our sincere thanks to our team, who have been working through since the first alert — and to you for your understanding and your patience.

Next update: at the restart on 10 November 2026, at the latest when the security update is released. For questions please use support.powerfolder.com.