waf

SiteGuard's statistics feature runs attacker commands as root

CVE-2026-106931, a command injection in SiteGuard WAF's default statistics function, is under active exploitation for root or SYSTEM execution.