Security researchers and Japan's JPCERT/CC report that attackers are actively exploiting CVE-2026-106931, a critical OS command-injection bug in the statistics feature of SiteGuard Server Edition, a web application firewall used on roughly 500,000 to 1.5 million sites. The flaw lets attackers run commands with root or SYSTEM privileges on hosts where the default-enabled statistics function is active, and the vendor has released patches for multiple affected versions, including some end-of-life builds.
bleepingcomputer.com
· 2026-10-18
Google's Mandiant and Threat Intelligence Group report that the ShinyHunters extortion gang, tracked as UNC6240, has modified its exploit for the Oracle PeopleSoft flaw CVE-2026-35273 to bypass web application firewall protections. By URL-encoding characters in the vulnerable /PSEMHUB/ endpoint path, such as '%50' for the letter 'P', attackers can slip past WAF rules that only check the literal, unencoded path while Oracle WebLogic still decodes and routes the request to the vulnerable endpoint.
bleepingcomputer.com
· 2026-09-26
An analysis of application security infrastructure finds that CDNs, WAFs, bot management, and identity systems each examine only isolated aspects of a session, leaving gaps that attackers exploit. By routing traffic through residential IPs or commercial VPNs and pairing valid credentials with convincing device fingerprints, malicious actors can pass through multiple defensive layers undetected.
bleepingcomputer.com
· 2026-09-01
GoKawiil