IT Daily Roundup: October 19, 2026
1. SiteGuard Server CVE-2026-106931 actively exploited, patch released
SiteGuard Server Edition is a web application firewall from Japanese vendor EG Innovations, running on more than 1.5 million websites. The vulnerability CVE-2026-106931 is in the statistics feature, which is enabled by default. An attacker who reaches the statistics interface can inject commands through unvalidated input: root on Linux and FreeBSD, SYSTEM on Windows. Both JPCERT/CC and the vendor confirmed active exploitation in the wild.
Affected versions are 2.20 and above before 8.00 Update 5 (Apache, Nginx, IIS) and before 7.00 Update 6 (FreeBSD). A patch is available for end-of-life versions as well. Before installing it, download diagnostic information from the web management interface (Diagnostic Information > Download) since patching may erase evidence of a prior intrusion.
Why this matters: WAFs typically run with system-level privileges and are whitelisted by endpoint protection. If an attacker takes over SiteGuard, they take over the server. The statistics module is on by default, even if you are not actively using it. Check your version and apply the patch today.
2. PwnEscape: Linux KVM flaw allows virtual machine escape
Researcher Paulos Yibelo of Pwn.ai discovered vulnerability CVE-2026-99999 in the Linux kernel KVM component using AI-assisted research tools. The flaw is in the networking stack: a guest OS can modify IP packets after the kernel has already validated them as safe. Through this gap an attacker can read host memory and, under certain conditions, execute code on the host. KVM underpins most low-cost VPS providers and x86 cloud platforms. That is practically every budget VPS.
Yibelo found the bug through Vercel's Sandbox Escape Challenge and earned a $50,000 reward. The Linux kernel team has patched it. The exact patched kernel version number has not been published yet. The flaw is considered easier to exploit than previous KVM escapes because it targets the general networking stack rather than a narrow configuration.
Why this matters: The patch exists, but your VPS or cloud provider has to apply it as a kernel update. Ask them when they plan to roll it out. If they cannot give you a concrete answer, consider isolating sensitive workloads or moving to a provider that responds to security updates promptly.
3. Attackers accessed Meta's GitHub repositories through one stolen password
Meta confirmed that an unknown attacker used stolen credentials from a single employee to access Meta's third-party GitHub repositories. Ninety-nine percent of the exfiltrated data is source code from various Meta products. The rest is personal data that was uploaded to GitHub in violation of internal policy. Meta is notifying approximately 1,500 people, most of them US employees.
Meta's internal systems were not breached. The attacker reached the code without penetrating the company's own infrastructure. One password was enough. Private GitHub repositories, including those hosted by third parties, are an entry point, and a single account without MFA is all it takes.
← All postsWhy this matters: Check how many of your developers have multi-factor authentication enabled on GitHub, GitLab, or Bitbucket. GitHub lets you enforce MFA across the whole organization in Settings > Authentication security. If repositories contain API keys or passwords, GitHub Secret Scanning detects them automatically and only needs to be turned on in the organization settings.