Cybercriminals Exploit Command Injection Vulnerability in SiteGuard WAF Server Edition
EG Secure Solutions has confirmed that cybercriminals are actively exploiting CVE-2026-106931 in SiteGuard Server Edition, a web application firewall installed directly on the protected server.
The flaw resides in the statistics processing function, which is enabled by default, and permits command injection that grants attackers the ability to run system commands as root on Unix or SYSTEM on Windows.
Security researchers assigned the weakness CWE-78 and scored it 8.5 on CVSS 4.0 and 7.8 on CVSS 3.0. Both ratings describe a local attack vector requiring low privileges and no user interaction.
While the published severity reflects the absence of confirmed remote unauthenticated exploitation, the high-privilege position of an on-server WAF makes successful compromise particularly impactful compared to typical application plugins.
Affected installations include all versions from 2.20 when statistics are active. Apache, Nginx, and IIS editions outside FreeBSD require updates up to 8.00 Update 5, while FreeBSD deployments with Apache or Nginx need 7.00 Update 6. IIS editions between 3.10 and 4.00 Update 4 remain unaffected.
The vendor alerted customers holding direct support contracts on 29 September. JVN published its advisory on 14 October, and JPCERT/CC issued a corresponding alert. Neither organization identified specific threat actors, targeted organizations, attack volume, or exact exploitation methods.
Administrators unable to apply the official update can obtain a patch that replaces the statistics processing files, including for versions whose support has ended. An immediate workaround is to disable the statistics function entirely.
Because the corrective patch removes traces of prior compromise, organizations are advised to first download diagnostic information through the web interface option labeled Information of Diagnosis before applying any fix.
Related articles
Roundcube Webmail Issues Security Updates to Address Multiple Vulnerabilities
The Roundcube Webmail development team released versions 1.7.5 and 1.6.20 on October 19, 2026, to resolve approximately 20 security issues affecting email viewing, authentication, and external content handling. The updates address command injection flaws in IMAP actions that could be triggered via newline characters, as well as header injection vulnerabilities involving sender display names and parameters such as References, In-Reply-To, Message-ID, and From. Additional fixes cover subject lines and data URIs in forwarded attachments, media types in inline images, and bypasses in server-side request forgery filters. The patches also mitigate cross-site request forgery evasion in spam reporting and cross-site scripting issues stemming from password driver error responses. Administrators are urged to apply the updates promptly to prevent exploitation of these weaknesses.
Check Point Discloses Two High-Impact Vulnerabilities in LiteLLM AI Gateway Allowing Low-Privilege Users to Steal API Keys
Check Point Research has disclosed two vulnerabilities, CVE-2026-35029 and CVE-2026-59823, in the LiteLLM AI gateway that affect all versions prior to 1.83.9. The flaws enable low-privilege authenticated users to modify gateway configurations, read server files, redirect traffic, and perform SSRF attacks to access internal resources. LiteLLM serves as a unified proxy for over 140 AI providers including OpenAI, Anthropic, and Azure OpenAI, managing API keys, routing, and usage monitoring for enterprises worldwide. The configuration update endpoint lacks role-based access controls, allowing any authenticated user to alter settings and potentially achieve remote code execution. Combined with the SSRF vulnerability, attackers can pivot from low-privilege accounts to compromise internal networks and exfiltrate stored credentials. The project has exceeded 61,000 GitHub stars and recorded over 90 million monthly downloads, making the issues particularly widespread due to its embedding in numerous internal AI platforms. Organizations are advised to upgrade immediately, audit access to management endpoints, rotate all API keys, and scan for hidden LiteLLM instances in requirements files and dependencies.
Gezine Demonstrates Debug Settings Access on PlayStation 5 Firmware 14.10
Security researcher Gezine has published a video showing access to the hidden Debug Settings menu on a retail PlayStation 5 running firmware version 14.10. Sony shipped the 14.00 update on October 1, which closed the previous kernel vulnerability used on 13.xx firmware, yet a new method was demonstrated only 18 days later. The technique is unrelated to the earlier Relapse exploit chain that worked up to version 13.60. Full system control is not achieved, and the previous method for extracting game executables no longer functions on 14.xx builds, likely requiring a separate hypervisor bypass. Gezine has stated that the new exploit details will not be released immediately and that any future disclosure decision will be made later.
Multiple Vulnerabilities Found in nginx Web Server, Three Rated Critical by F5
F5 disclosed an out-of-band security advisory on October 14, 2026, revealing a total of 11 vulnerabilities across nginx and related products. Five issues affect the core open-source nginx server while six more impact associated offerings including NGINX Gateway Fabric and NGINX Ingress Controller. The flaws can lead to denial of service, remote code execution, authentication bypass, and sensitive information disclosure. Although the official nginx project rates all five core vulnerabilities as Medium severity, F5 assigns a CVSS v4.0 base score of 9.2 to three of them, classifying them as Critical. One example is CVE-2026-15176, a heap buffer overflow in the ngx_http_core_module that triggers under specific URL rewrite and file-path configuration settings.