Oct 19, 2026 · 3 min · 5 segments
Attackers are exploiting a SiteGuard web application firewall flaw to run commands as root or system, turning a security control into the way in. Plus, Dragos says fewer than ten percent of OT…
The device you bought to keep attackers out is now the thing letting them in.
Attackers are actively exploiting a flaw in SiteGuard's web application firewall, and the result is command execution with the highest privileges on the machine.
Nothing sits above that.
Think about where a web application firewall lives.
It sits in front of your applications, it inspects your traffic, and it often holds the certificates and configuration that describe your whole environment.
Own that box, and you aren't just past the perimeter, you are the perimeter.
You can watch traffic, quietly change what gets blocked, and step from there into whatever it protects.
So the practical work today is short and unglamorous.
First, find out whether you run SiteGuard at all, including instances a vendor or a past project stood up and nobody remembers.
Second, check whether any management interface is reachable from places it shouldn't be.
Third, apply the vendor's fixes promptly and treat any unpatched exposed unit as potentially compromised until you have looked at it.
Exploitation is already happening, so waiting for the next patch cycle is a bet you don't need to make.
And this is part of a bigger pattern.
Edge and management tooling, the stuff that's trusted by default and watched by almost no one, keeps becoming the place attackers get their first real foothold.
Hold that thought because the same blind spot shows up somewhere very different.
The device you bought to keep attackers out is now the thing letting them in.
Attackers are actively exploiting a flaw in SiteGuard's web application firewall, and the result is command execution with the highest privileges on the machine.
Nothing sits above that.
Think about where a web application firewall lives.
It sits in front of your applications, it inspects your traffic, and it often holds the certificates and configuration that describe your whole environment.
Own that box, and you aren't just past the perimeter, you are the perimeter.
You can watch traffic, quietly change what gets blocked, and step from there into whatever it protects.
So the practical work today is short and unglamorous.
First, find out whether you run SiteGuard at all, including instances a vendor or a past project stood up and nobody remembers.
Second, check whether any management interface is reachable from places it shouldn't be.
Third, apply the vendor's fixes promptly and treat any unpatched exposed unit as potentially compromised until you have looked at it.
Exploitation is already happening, so waiting for the next patch cycle is a bet you don't need to make.
And this is part of a bigger pattern.
Edge and management tooling, the stuff that's trusted by default and watched by almost no one, keeps becoming the place attackers get their first real foothold.
Hold that thought because the same blind spot shows up somewhere very different.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.