Update: security update for PowerFolder Server — release candidate available on request

• PowerFolder Server (self-hosted): the release of the security update is delayed because final testing is still in progress. We will publish the update only once all tests have passed.
• Release candidate available: a release candidate (RC) containing all security fixes is ready. Operators who want to deploy it in advance can request it via support.powerfolder.com.
• Until it is installed: keep blocking all requests to /wopi/ at your reverse proxy or firewall — also for your document server. Disabling online editing in the settings does not protect you. If in doubt, take the server offline.
• PowerFolder Cloud: the restart is still planned for Tuesday, 10 November 2026.

What the security update contains

The update closes the vulnerabilities exploited in the attack. We have brought forward security fixes that were already planned, and closed further vulnerabilities we found during the comprehensive review of our code. The update also adds new protections, including mandatory two-factor sign-in for server administrators, shorter lifetimes for sign-in tokens and logging of administrator sign-ins and configuration changes. We will publish details of the individual vulnerabilities only once operators have had time to update.

We will announce the date of the final security update here and directly to operators.

For questions please use support.powerfolder.com.