Patching the firewall erases the evidence

Attackers are exploiting an operating-system command-injection flaw in SiteGuard Server Edition, a web application firewall, to run commands with root or SYSTEM privileges on affected machines. The vulnerability is tracked as CVE-2026-106931 and sits in the statistics function, which is enabled by default. The product comes from a leading Japanese vendor that claims to protect more than 1.5 million websites; WordPress.org statistics show it active on 500,000.

Both the vendor's bulletin and a warning from Japan's CERT agency rate the flaw critical and confirm that abuse has been observed. Neither says who is behind the attacks, who the victims are, how widespread the activity is, or what methods were used.

The affected builds are Server Edition for Apache httpd, Nginx and IIS, excluding FreeBSD, from version 2.20 up to but not including 8.00 Update 5; and for Apache httpd and Nginx on FreeBSD, from 2.20 up to 7.00 Update 6. Exploitation requires the statistics function to be active, and JPCERT/CC notes that IIS editions 3.10 through 4.00 Update 4 inclusive are unaffected. Where an upgrade is impossible the vendor offers a patch replacing the files used in statistics processing, including for versions already past end of life.

The instruction most likely to be skipped is the one that matters afterwards. The vendor warns that remediation may erase the traces of an attack and recommends preserving evidence first: download and retain the diagnostic information from the web management interface before updating or patching. Customers with direct support contacts were notified of the flaw earlier, on 29 September.