Per Bleeping Computer, hackers are actively exploiting a critical OS command-injection vulnerability, tracked as CVE-2026-106931, in the SiteGuard Server Edition web application firewall. This flaw allows attackers to execute commands with root or SYSTEM privileges on compromised systems.
The vulnerability resides in the statistics feature of the SiteGuard Server Edition, which is enabled by default. This feature is present in versions 2.20 and later for Apache httpd, Nginx, and IIS (excluding FreeBSD) before 8.00 Update 5, and for Apache httpd and Nginx on FreeBSD before 7.00 Update 6. While the exact scale and victims of the ongoing attacks remain unclear, the vendor, SiteGuard, a prominent Japanese WAF provider protecting over 1.5 million websites, has confirmed that abuse has already been observed. SiteGuard has released a patch and advises administrators to preserve diagnostic information before applying updates or patches, as remediation may erase evidence of the attack. Installations that cannot be upgraded can use a patch provided by the vendor.
Source: Bleeping Computer
