> TritonInfoSec News
Home / Oct 19, 2026 / Story
0
#4 BleepingComputer general October 18, 2026 at 14:23 UTC

Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root

By Bill Toulas

AI Summary

Attackers are actively exploiting an OS command injection vulnerability in JP-Secure's SiteGuard Server Edition WAF, allowing unauthenticated or low-privileged attackers to execute arbitrary commands as root on Linux or SYSTEM on Windows. The flaw affects server-side WAF deployments, meaning organizations using SiteGuard to protect web applications may themselves be the attack surface. Administrators should apply vendor patches immediately and review server logs for anomalous process execution.

Read full article → https://www.bleepingcomputer.com/news/security/hac…

Relevance score: 72.0/100

# More from October 19

  1. 1
    ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants The Hacker News
  2. 2
    Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants The Hacker News
  3. 3
    Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel SecurityWeek
  4. 5
    MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon The Hacker News
  5. 6
    Krybit ransomware: what you need to know Graham Cluley
  6. 7
    US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars SecurityWeek
  7. 8
    Anthropic gives outside AI watchdog “employee-like” access Ars Technica Security
  8. 9
    Irish police force has its Twitter hacked in cryptocurrency scam Graham Cluley
  9. 10
    Inbox flooded with sign-up messages? Email bombing explained WeLiveSecurity (ESET)