🚨 Hackers are actively exploiting a high-severity UnrealIRCd flaw.

CVE-2026-114713 (CVSS 8.6) lets attackers inject commands with server-level privileges.

CISA has added it to its exploited vulnerabilities list. Patch now.

Details: https://thehackernews.com/2026/11/attackers-exploit-unrealircd-flaw-that.html

CISA added a high-severity security flaw impacting UnrealIRCd to its Known Exploited Vulnerabilities catalog following reports of active exploitation.

Tracked as CVE-2026-114713 with a CVSS score of 8.6, the vulnerability involves improper neutralization allowing arbitrary command execution.

Affected versions include UnrealIRCd 6.0.0 through 6.2.7.0 due to issues in the labeled-response module.

Project leader Bram Ma…

https://en.hacks.gr/sovaro-keno-asfaleias-sto-unrealircd-mpainei-sto-stochastro-epitheseon/

#UnrealIRCd #CISA #CVE_2026_114713 #Vulnerability

📰 CISA Warns of Actively Exploited Critical Flaw in UnrealIRCd

CISA adds critical UnrealIRCd flaw (CVE-2026-114713) to KEV catalog. The command injection bug allows server-level command execution and is actively exploited. Update to version 6.2.7.1 immediately. #CVE #UnrealIRCd #ThreatIntel

🔗 https://cyber.netsecops.io/articles/cisa-warns-of-actively-exploited-unrealircd-flaw-cve-2026-114713/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Check Point: CVE-2026-123039 (escalation a root via DynamicCLI) sfruttata contro "un paio di dozzine" di clienti (vendor). In CISA KEV dal 13/11, scadenza 16/11.

Catena (Check Point Research): ingresso dal portale Mobile Access con PHP2Shell, poi root sul gateway, webshell e backdoor; in alcuni casi wiper su ESXi.

Fix: Jumbo Hotfix R82.20 Take 14, R82.10 Take 52, R82 Take 132, R81.20 Take 174. Senza patch: fermare dynamic_server.

https://support.checkpoint.com/results/sk/sk1000362

#CheckPoint #infosec

FAA Ground Stop, Plus 4 More Tech Stories https://raymondtec.com/2026/11/faa-nationwide-ground-stop-check-point-microsoft-365/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief

A network change helped ground U.S. flights nationwide. Also: Check Point attacks, Microsoft 365 continuity, Uber’s AI-vendor breach, and a PostgreSQL backup warning.

#TechNews #CheckPoint #CVE2026123039 #databreach #FAA #FireworksAI #Microsoft365

📰 Check Point Zero-Day Exploited to Gain Root Access, Deploy Wiper

Actively exploited Check Point zero-day (CVE-2026-123039) allows root access on security gateways. Attackers are pivoting to VMware ESXi hosts to deploy destructive wiper malware. CISA added to KEV. Patch now! #CyberSecurity #ThreatIntel #CVE

🔗 https://cyber.netsecops.io/articles/check-point-zero-day-cve-2026-123039-exploited-to-deploy-wiper/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

CVE-2026-124194: lo zero-day di Outlook che ruba l’hash NTLMv2 aprendo un file Office
#tech
https://spcnet.it/cve-2026-124194-lo-zero-day-di-outlook-che-ruba-lhash-ntlmv2-aprendo-un-file-office/
@informatica

New in the known-exploited catalogue: CVE-2026-124194 in 365_apps. Exploited in the wild — the only phrase in this field that still means exactly what it says.

Patch the edge appliance. It is always the edge appliance.

#KEV #vulnerability

CVE-2026-124194: Outlook NTLM Zero-Day Explained

https://thecybersecguru.com/news/cve-2026-124194-outlook-ntlm-zero-day/

🚨 Critical Red Hat Quay Vulnerability (CVE-2026-123710 | CVSS 9.8)

An unauthenticated authorization bypass in the /keys endpoint lets attackers upload rogue signing keys and hijack private container repositories.

https://denizhalil.com/2026/11/14/red-hat-quay-cve-2026-123710-vulnerability-analysis/

#CyberSecurity #InfoSec #RedHat

🚨 A Windows Common Log File System flaw can let a local attacker escalate privileges to SYSTEM; CVE-2023-28252

PoC: https://github.com/Joe1sn/CVE_2023_28252

The vulnerability is a heap-based buffer overflow in the Windows CLFS driver. Successful exploitation can allow a local attacker to elevate privileges and execute code with SYSTEM-level permissions.

Microsoft patched the flaw in April 2023, and CISA added it to the Known Exploited Vulnerabilities catalog the same day.

Windows CLFS | Local Privilege Escalation:

• CVSS: 7.8 High
• Attack: Local
• Impact: Privilege escalation to SYSTEM
• CWE: CWE-122 Heap-based Buffer Overflow
• Status: Actively exploited in the wild / patched by Microsoft

The PoC demonstrates exploitation of the vulnerable CLFS driver on affected Windows systems.

Brotliの脆弱性の件はNode2ShellやHTTP2Shellとか言われてたけど、このBroccoli2Shellにおおよそ情報が集約されている認識でよろしいでしょうか。
---
Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497)
https://broccoli2shell.com/
#bookmarks

CVE-2026-63448 in Suricata SMB parser: unbounded transaction growth on one-sided flows can degrade or stall inspection. CVSS 5.9. Fixed in 7.0.17 and 8.0.6, patch now. #CVE #infosec #Suricata https://www.valtersit.com/cve/CVE-2026-63448/

🚨 A critical MISP Modules authorization flaw can let unauthenticated attackers modify external tool configurations; CVE-2026-127016

PoC: https://github.com/fumioryoto/CVE-2026-127016

The vulnerability affects the MISP Modules website component, where external tool management endpoints fail to enforce the configured administrator authentication policy.

An unauthenticated attacker with network access can add or remove tools, toggle their status, and modify settings including API keys and ingestion URLs.

MISP Modules | Missing Authorization:

• CVSS: 9.2 Critical
• Affected: MISP Modules ≤ 3.1.4
• Attack: Remote, unauthenticated
• Impact: External tool configuration tampering, API key changes, ingestion URL modification
• CWE: CWE-862 Missing Authorization

The issue only applies when ADMIN_PASSWORD is configured; installations without an admin password intentionally allow open management access.