Hackers exploit SiteGuard WAF command injection flaw for root access

🚨 ACTIVE EXPLOITATION

• Hackers exploit SiteGuard WAF command injection flaw to run commands as SYSTEM, root
  Attackers are actively exploiting an OS command injection vulnerability (CVE-2026-106931) in SiteGuard Server Edition WAF to execute commands with root or SYSTEM privileges.
  • SiteGuard Server Edition WAF, used on hundreds of thousands of sites by Japanese vendor EG Secure Solutions, is affected in versions 2.20 and later with the statistics feature enabled (on by default).
  • Vulnerable versions: Apache/Nginx/IIS (excluding FreeBSD) before 8.00 Update 5; FreeBSD Apache/Nginx before 7.00 Update 6; IIS editions 3.10 through 4.00 Update 4 are not affected.
  • The flaw allows arbitrary OS command execution with root or SYSTEM privileges; analysts note it requires prior local access with a low-privileged account, acting as a privilege-escalation step.
  • Exploitation has been confirmed in the wild per the vendor and JPCERT/CC; CVSS 3.0 score is 7.8 and CVSS 4.0 is 8.5.
  • Support customers were notified September 29, 2026, with the public alert issued October 14, 2026.
  Sources 📄 Source: eg-secure.co.jp · 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

🕵️ RESEARCH & DEEP DIVES

• This Week in Security Oct 18: fridge mass-hacks, OpenAI insider bug, ad-delivered spyware
  Zack Whittaker's October 18 newsletter covers European supermarket fridge hacks, an OpenAI insider planting a recording device, ad-delivered zero-click spyware, and crypto wallet implants.
  • Thousands of internet-connected Danfoss refrigeration units in hundreds of European supermarkets were hacked, causing defrosting, spoiled food, and supply disruption; the older models no longer receive security patches.
  • Ahold Delhaize pulled its US network offline after a cyberattack, disrupting Stop & Shop, Hannaford, and Food Lion websites and apps; no data theft confirmed yet.
  • An OpenAI employee, a Saudi national, was arrested by the FBI for allegedly planting a covert internet-connected microphone in an executive conference room.
  • Citizen Lab found Israeli adtech firm Discover-Tech delivered Candiru zero-click spyware via online ads, hitting dozens of Al Jazeera devices.
  • Implants in some Trezor and Ledger hardware wallets stolen seed phrases over the cell network, with roughly $100 million in crypto stolen so far.
  Sources 📄 Source: schneier.com · 📎 Coverage: this.weekinsecurity.com · 👁 via @zackwhittaker@mastodon.social

🔓 CVEs & KEV

• CVE-2026-110024 — @fastify/jwt — CVSS 6.8 — @fastify/jwt vulnerable to missing token expiration when per-call options dro...

• CVE-2026-112062 — lwIP — CVSS 6.0 — lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler...