Fix guides / Security notices

Security notice

Does your server run SiteGuard Server Edition? Attacks are confirmed. Update now.

Last updated: Thursday, October 22, 2026, 3:52 PM ETStatus: Fix released. Being exploited: the vendor has confirmed attacks and CISA lists it as exploited.

SiteGuard Server Edition is a web application firewall from EG Secure Solutions, a Japanese company. It sits on Apache, Nginx and IIS web servers to block attacks on websites. On October 14, 2026, the company disclosed a flaw in the product's statistics feature, CVE-2026-106931, which could let an attacker run any command on the server with root or SYSTEM rights, the highest level of control. The company says the flaw is already being abused. The US agency CISA added it to its list of exploited flaws on October 20. The product is used mostly in Japan, so most of our readers will not be affected. If your business, your host or your agency runs SiteGuard Server Edition, update it today.

What happened

Who should worry

Ask about this if your website runs on a server where SiteGuard Server Edition is installed. That is most likely if you are a business in Japan, or your host or agency manages servers for Japanese sites. You are affected if all of these are true:

The IIS edition from version 3.10 through 4.00 Update 4 is not affected. (EG Secure Solutions, JPCERT/CC) These advisories cover SiteGuard Server Edition only; they do not list the separate free SiteGuard WP Plugin for WordPress. If you have never heard of SiteGuard, you almost certainly don't run it.

What to do now

Do these today.

  1. Ask the question. Send the message below to your host, agency or server administrator. You need a clear answer: do any of our servers run SiteGuard Server Edition, and which version?
  2. Save the evidence first. The company warns that updating or patching may erase traces of an attack. Before you update, download the "Diagnostic information" from the SiteGuard web management screen and keep it. (EG Secure Solutions)
  3. Update. The fix is in 8.00 Update 5 for Apache, Nginx and IIS, and 7.00 Update 6 for Apache and Nginx on FreeBSD. If you cannot upgrade, the company offers a patch that replaces the statistics files, including for versions that no longer get support. (EG Secure Solutions)
  4. If you cannot do either today, turn off the statistics feature. JPCERT/CC says this avoids the flaw until you can update. (JPCERT/CC)
  5. Check for signs of attack. JPCERT/CC recommends looking into whether the server was compromised, not just updating. If anything looks wrong, bring in a security professional. (JPCERT/CC)

What to send your developer, agency or host

EG Secure Solutions disclosed CVE-2026-106931 in SiteGuard Server Edition on October 14, 2026. It is an OS command injection flaw in the statistics feature (on by default) that can let an attacker run commands as root or SYSTEM. The vendor says it is being exploited, JPCERT/CC issued alert JPCERT-AT-2026-0032, and CISA added it to the Known Exploited Vulnerabilities catalog on October 20. Please confirm whether any server you run for us has SiteGuard Server Edition installed and which version. If it does, please download and keep the "Diagnostic information" from the SiteGuard web management screen first, then update to 8.00 Update 5 (or 7.00 Update 6 on FreeBSD) or apply the vendor's patch today. If that is not possible today, please turn off the statistics feature and check the server for signs of compromise. Sources: EG Secure Solutions advisory, JPCERT/CC alert.

Technical steps

Step 1. Check your edition and version

Affected: 2.20 or later and below 8.00 Update 5 on Apache, Nginx and IIS; below 7.00 Update 6 on FreeBSD. IIS 3.10 through 4.00 Update 4 is not affected. If you are unsure, ask your support desk or the reseller you bought it from. (EG Secure Solutions)

Step 2. Preserve evidence

In the SiteGuard web management screen, go to Diagnostic information and choose Download diagnostic information. Keep the file before you change anything. (EG Secure Solutions, BleepingComputer)

Step 3. Update or patch

Update to 8.00 Update 5 (7.00 Update 6 on FreeBSD), or apply the vendor's patch that replaces the statistics processing files. (EG Secure Solutions)

Step 4. Stopgap

If you cannot update yet, disable the statistics feature. See the vendor's instructions. (JPCERT/CC)

Step 5. Investigate

CISA lists this flaw as one that needs forensic triage. Review the server for unexpected accounts, processes, scheduled jobs and changed files. (CISA KEV, JPCERT/CC)

Common questions

Has my business been hacked?

This notice does not mean your business has been hacked. The vendor confirms attacks are happening but has not said who was targeted or how many. If you run an affected version, update and check the server for signs of compromise rather than assume either way.

Can EverThread tell me if I am affected?

No. EverThread checks websites from the outside, the way a browser sees them. We cannot see what security software or which versions run on your server, and we do not test for this flaw. Your host or server administrator can check in a few minutes. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

My site is on WordPress and uses the SiteGuard WP Plugin. Is that the same thing?

No. The advisories cover SiteGuard Server Edition, a firewall installed on the server. They do not list the free SiteGuard WP Plugin. Keep your plugins updated as usual.

We are not in Japan. Do we need to worry?

Probably not. The product is used mostly in Japan. If you have never installed SiteGuard and your host has not mentioned it, this is unlikely to apply to you.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

We email you a link to confirm first, and every alert has a one-click unsubscribe. Alerts can include a short note about EverThread. Already a customer? Use your account email and your alerts include a link to your dashboard. Privacy

Sources

While you are here

Check your site's other basics free. We look at your home page the way a browser does and tell you in plain English. This scan does not check for the SiteGuard flaw above. No account.

Or sign up free and we check it every day and email you when something changes.