← All security news
SecurityVulnerabilityCRITICOEXPLOITED IN THE WILD

SiteGuard Server Edition WAF flaw exploited to run commands as root

· 1 min di lettura

An OS command injection in the widely used Japanese web application firewall is being exploited. It is on by default; collect diagnostics before you upgrade.

This article is not yet available in your language; it is shown in English.

VULNERABILITYSiteGuard Server EditionCVE-2026-106931EXPLOITED

EG Secure Solutions disclosed CVE-2026-106931, an OS command injection in SiteGuard Server Edition, a host-based WAF common on Japanese web servers. An attacker can run arbitrary OS commands with root / SYSTEM privileges. The vendor has confirmed exploitation, and JPCERT/CC issued an alert on 14 October.

The flaw is in the statistics feature, which is enabled by default. Affected: Ver2.20 and later — Apache, Nginx and IIS editions before Ver8.00 Update5, and FreeBSD Apache/Nginx editions before Ver7.00 Update6. The IIS edition Ver3.10 to Ver4.00 Update4 is not affected.

The vendor warns that upgrading may erase traces of a compromise. Collect the diagnostic information (診断情報) from the web admin console first. If you cannot upgrade, the vendor offers a patch for the statistics component, or you can disable the statistics feature.

More news

PHP
VulnerabilityCRITICOEXPLOITED IN THE WILD

CISA confirms PHP2Shell is exploited; US agencies must patch by 29 October

The two PHP core flaws fixed on 21 October are now in CISA's Known Exploited Vulnerabilities catalog, and JPCERT/CC reports public exploit code and attack traffic.

· CVE-2026-109618 · CVE-2026-109619
Binance
IncidentCRITICO

FBI: North Korea's TraderTraitor stole more than $6 billion from Binance; about $2.85–3 billion frozen as funds move into Ethereum

On 31 October the FBI officially blamed North Korea for the 29 October Binance theft, the largest on record. Elliptic counts $6.43 billion stolen and $2.85 billion frozen. The FBI says the hackers are converting assets mainly into ETH and asks crypto services to block their addresses.

Amadeus
IncidentALTO

Amadeus breach: attackers read airline booking data for three years; JAL, ANA, Cathay Pacific and Korean carriers affected

An unauthorised party used a system account's login to read reservation data on Amadeus systems from August 2023 to September 2026. JAL reports about 92,000 customers affected, ANA about 37,800 and Cathay Pacific about 53,000 bookings; some passport numbers were exposed.