Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems. In a new Windows release health dashboard update over the weekend, Microsoft said users may have trouble accessing email or signing in to Outlook after installing the latest updates on systems running Windows Server 2019 and later. In some cases, affected customers are also reportedly seeing Exchange Server OWA failing with a "MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142)" error and Event ID 1006 in the application log. "After installing the October 2026 Windows security update [..], some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication," it said.
Attackers are exploiting vulnerability CVE-2026-106931 in SiteGuard Server Edition to run commands as root or SYSTEM. EG Secure Solutions published an urgent alert warning of CVE-2026-106931, an OS command injection bug in SiteGuard Server Edition. Threat actors are already exploiting it in the wild. A successful exploit lets them run commands with root or SYSTEM privileges on the server where the product runs. SiteGuard is a Japanese web application firewall (WAF) that runs directly on the web server it protects. The vulnerability affects its statistics feature, which is enabled by default. The vendor and JVN rated the vulnerability with a CVSS 4.0 score of 8.5 and a CVSS 3.0 score of 7.8. An attacker needs local access and low-level privileges to exploit this vulnerability. This suggests the flaw may be used after an attacker has already gained access to a system. The vulnerability impacts version 2.20 or later. On Apache, Nginx and IIS that means anything before 8.00 Update 5, except FreeBSD, and on FreeBSD with Apache or Nginx it means anything before 7.00 Update 6. IIS editions from 3.10 through 4.00 Update 4 aren’t affected, and only installs with the statistics function enabled are exposed. For people who can’t upgrade their version, the vendor offers a patch that replaces the files used in statistics processing, and it covers end-of-life versions too. Be aware that updating or patching can erase the traces of an attack, so the vendor tells administrators to download the diagnostic information first. “Before updating, please be sure to download and save your “Diagnostic Information” (as this may erase traces of the attack).” reads the vendor’s advisory. In the web management screen that’s the diagnostic information page, then the download option. Do it before you touch anything, because a clean server after the update doesn’t prove it was clean before. The timeline is short, but not everyone was warned at the same time. The vendor says it notified customers with direct support contracts on September 29. The public alert and the JVN advisory were published on October 14. The vendor reported the vulnerability to Japan’s IPA, while JPCERT/CC coordinated the disclosure and published its own alert. Customers without direct support contracts received the warning about two weeks later. Many details remain unknown. Neither advisory identifies the attackers or victims, explains how the attacks were carried out, or says how many systems were affected. The vendor has confirmed that the vulnerability has been exploited. If you use this product, check your systems for signs of compromise and investigate any suspicious activity. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, SiteGuard WAF)
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps
In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines and hotels run support intake. Both are standard, documented, as-designed features. Chained together,
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic
An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without
Hackers are exploiting an OS command-injection vulnerability in the SiteGuard Server Edition web application firewall (WAF), allowing them to execute commands with root or SYSTEM privileges on affected machines. The security issue is tracked as CVE-2026-106931 and affects the statistics feature in host-based WAF instances, which is enabled by default. SiteGuard is a leading Japanese WAF vendor that claims to protect more than 1.5 million websites. Based on WordPress.org statistics, the product is active on 500,000 sites. According to the vendor’s bulletin and a warning from Japan's CERT agency, CVE-2026-106931 has critical severity and is currently being exploited in the wild. “An OS command injection vulnerability (CVE-2026-106931) has been found in the statistics function of SiteGuard Server Edition. Abuse has already been confirmed,” reads SiteGuard’s alert.
Confirm this action.
Leaving now will discard your changes.