CISA Adds UnrealIRCd CVE-2026-114713 to KEV Catalog Following Active Exploitation

CISA Adds CVE-2026-114713 and CVE-2026-123039 to Known Exploited Vulnerabilities Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog after confirming active exploitation in the wild. The entries include CVE-2026-114713 affecting UnrealIRCd and CVE-2026-123039 impacting multiple Check Point products. These vulnerabilities are described as frequent attack vectors that can grant attackers full control of compromised assets. Federal Civilian Executive Branch agencies must follow BOD 26-04 requirements to prioritize remediation of KEV-listed issues on publicly exposed systems. The directive also requires agencies to verify whether threat actors have already compromised systems before applying patches. CISA encourages all organizations to adopt similar risk-based vulnerability management practices and provides a nomination form for submitting additional exploited vulnerabilities.

PostgreSQL Patches 52 Flaws Including 22-Year-Old Bug Enabling Authenticated RCE

The PostgreSQL Global Development Group has released updates addressing 52 security vulnerabilities, one of which is a type confusion flaw dating back to 2004 that allows authenticated remote code execution. Tracked as CVE-2026-6460 with a CVSS score of 8.8, the issue affects composite types and can be exploited by users with object creation privileges. Researcher Mehmet Ince published a working exploit that involves preparing queries, altering field types, and triggering memory operations leading to code execution. All versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25 are impacted, and administrators must also rebuild C-language extensions. Additional fixes cover client tools such as pg_restore and psql, while one unauthenticated flaw can restart PostgreSQL 18 servers. No in-the-wild exploitation has been observed according to CISA and project assessments.

Check Point Security Gateways Compromised via PHP2Shell Exploits to Deploy VMware ESXi Data Wiper

Vulnerable Check Point Security Gateway instances were targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts. The campaign began on October 30 against Israeli organizations and later expanded to multiple countries. Attackers exploited two critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 for unauthenticated remote code execution, then chained them with a zero-day tracked as CVE-2026-123039 for root access. They installed PHP webshells and the TSGA backdoor with TSProxy networking component before moving laterally to ESXi hosts using the gogo scanner. In the final stage, the destroy_v6 wiper was deployed to recursively delete data with optional zero-fill overwriting. Political messages referencing Dream Security Ltd. were left on some systems, raising false-flag concerns. Check Point linked elements to the PhiliKit framework associated with UNC5221 but could not confirm attribution.