Briefing · Monday 9 November 2026 · 07:00 UTC
UnrealIRCd reports active exploitation of server command flaw
By CyberSIXT Briefing · from 22 reports by 6 outlets · Editorial policy
UnrealIRCd says attackers are exploiting CVE-2026-114713, which can let ordinary users execute commands with server or IRC operator authority; JPCERT/CC has also warned of attacks on CVE-2026-111793 in Openwave Webtop Media Transcoder.SecurityOnlineSecurityOnline The disclosures identify exploitation in the wild, but neither source names an attacker, and the Openwave notice describes a flaw affecting authenticated users.SecurityOnlineSecurityOnline Separately, StepSecurity reports a compromised Bee JS package release with malicious code that runs during installation.StepSecurity
UnrealIRCd confirms exploitation of server command flaw#
The UnrealIRCd project said CVE-2026-114713 is being exploited in the wild and affects versions 6.0.0 through 6.2.7; the flaw is fixed in version 6.2.7.1.SecurityOnline The flaw is in the labelled-response module, where failure to escape an IRCv3 label tag in echoed replies can cause linked servers to treat injected lines as commands with server authority.SecurityOnline The project said ordinary users can use the issue to execute commands with server or IRC operator authority, and the CVE record rates it CVSS 8.6 (High, v3).SecurityOnline The project offers a spamfilter workaround and hot-patch bundle-20261107 for versions 6.0.0 to 6.2.7, as well as the upgrade to 6.2.7.1; the disclosure does not identify the attackers.SecurityOnline
Openwave warns of exploitation of Webtop file restriction flaw#
JPCERT/CC warned that attackers are exploiting CVE-2026-111793 in Openwave Webtop Media Transcoder, citing attacks observed by the developer.SecurityOnline The vulnerability affects versions before 1.1.22.0 and arises because the transcoder does not enforce administrator-defined file type restrictions, allowing an authenticated user to submit files intended to be blocked.SecurityOnline Openwave recommends upgrading to 1.1.22.0 or later, or moving to a supported Media Server 2.0 release.SecurityOnline The advisory describes possible information disclosure, gives the issue a CVSS v3 score of 4.3 (Medium), and does not name an attacker or provide a count of affected systems.SecurityOnline
StepSecurity identifies compromised Bee JS release#
StepSecurity reported that @ethersphere/bee-js version 13.3.0, released to npm on 9 November 2026, was compromised and runs attacker-controlled JavaScript during installation.StepSecurity The code targets Swarm Desktop wallet data and attempts to establish persistent access on Linux, macOS and Windows; StepSecurity said version 13.2.0 remains free of the malicious installation path.StepSecurity The payload can search for config.yaml and data-dir/keys/swarm.key and, if present, exfiltrate them, while the installation hook retrieves platform-specific code from an external domain.StepSecurity StepSecurity said the package’s release identity may have been misused, potentially through stolen credentials, but it did not establish which credential was involved.StepSecurity
Also
- SMBC Consumer Finance. SMBC Consumer Finance said attackers took personal data relating to up to 320,118 people from its card-loan guarantee system, which remains suspended.CyberSIXT
- Beget. Beget said its cloud platform was destroyed in the 2 November attack and surviving file backups cover only about half of its VPS users.CyberSIXT
- ModSecurity. The OWASP ModSecurity project disclosed two vulnerabilities, CVE-2026-104269 and CVE-2026-73857, both fixed in libmodsecurity 3.0.17, and said no exploitation had been confirmed at publication.SecurityOnline
Watching
Brenner Base Tunnel SE has not identified which files were accessed, while Everest’s claim that it stole 812 GB has not been independently verified.Security Affairs