Upcoming critical UnrealIRCd security release on Saturday 7-Nov-2026
Posted: Wed Nov 04, 2026 8:40 am
On Sat 7 November 2026 at 15:00 UTC we will release UnrealIRCd 6.2.7.1 along with a hot-patch for UnrealIRCd 6 (no restart needed). This fixes multiple security issues in UnrealIRCd, including one issue rated as CRITICAL. We will send an announcement to the mailing list (please subscribe if you haven't done yet), do a post on these forums and put it on the frontpage of unrealircd.org.
Below is additional information, such as: how important it is to be around and who does not get the hot-patch.
We also recommend today to run a hot-patch test (see below under "Recommended today: try a test hot-patch beforehand"). This way you can check if hot-patching works on your server. Installing the test hot-patch and how to verify installation is very similar to what needs to be done on Saturday with the real security patch so this also makes you familiar with the procedure.
Should I be around that day, and what will I have to do?
Yes, please be around at Saturday 7 November 2026 at 15:00 UTC. We HIGHLY recommend you do everything in the advice DIRECTLY after the announcement. Do not wait for hours or days.
In the announcement there will be a workaround for the 1 critical issue and an ./unrealircd hot-patch command that you should run immediately after the workaround. The hot-patch can be used to fix all issues without restarting UnrealIRCd, with no impact on your users or uptime.
Who will NOT get the hot-patch?
Windows users: there will be no hot patch. You will have to install UnrealIRCd 6.2.7.1. This means on Windows you will have to restart your IRC server.
If you are using git: you should know that we only support releases and the hot-patches are made for releases. If you cloned your git at a release point then hot patching may work, but if the git version you are using is like halfway between version X and Y then hot patching may fail. In that case either install 6.2.7.1 or do a git pull right after the release and recompile. Both require a restart.
If you run a -rc/-beta version: this is similar to a git version. Hot-patching may fail, then you will need to install 6.2.7.1 and restart the server.
Recommended today: try a test hot-patch beforehand
All fixes come out as one hot-patch which works without a restart. A great mechanism, I even published an article on my blog about this, but this aside. However, in some semi-rare cases the hot-patch command may fail, such as after a distro upgrade.
This is why we have published a TEST hot-patch. This hot-patch does not fix any particular bug. It just changes a version field in the "eos" module.
To test, you run:
When you run that command, the last sentence you should see on that screen should be "Patch installed and server rehashed correctly. All should be good now!" or in older versions "Done! All should be good now".
If something went wrong (you did not get that output) then please check out FAQ: Hot-patching failed. It contains answers for several scenarios, including the distro upgrade and compiler case.
Now you can verify that the module is actually the hot patched version. You have two options (pick one):
This means the test-patch is NOT installed: eos 5.0
If you use the IRC command then note that only IRCOps can see the version field and the "5.0" versus "5.0-hot-patch-test-6" difference. So be sure to run that command as an IRCOp. Perhaps good to know, you can also check remote servers: /MODULE -all irc2.example.net
Updates / Questions
Any updates to this pre-announcement will be here in this thread. Do you still have questions after reading this post then you can ask them here.
Unfortunately more details about the security issues will not be provided, eg: the nature, area, exact affected version range, etc. But if you have a problem or question with the test hot-patch or something else about the procedure, then feel free to ask.
Below is additional information, such as: how important it is to be around and who does not get the hot-patch.
We also recommend today to run a hot-patch test (see below under "Recommended today: try a test hot-patch beforehand"). This way you can check if hot-patching works on your server. Installing the test hot-patch and how to verify installation is very similar to what needs to be done on Saturday with the real security patch so this also makes you familiar with the procedure.
Should I be around that day, and what will I have to do?
Yes, please be around at Saturday 7 November 2026 at 15:00 UTC. We HIGHLY recommend you do everything in the advice DIRECTLY after the announcement. Do not wait for hours or days.
In the announcement there will be a workaround for the 1 critical issue and an ./unrealircd hot-patch command that you should run immediately after the workaround. The hot-patch can be used to fix all issues without restarting UnrealIRCd, with no impact on your users or uptime.
Who will NOT get the hot-patch?
Windows users: there will be no hot patch. You will have to install UnrealIRCd 6.2.7.1. This means on Windows you will have to restart your IRC server.
If you are using git: you should know that we only support releases and the hot-patches are made for releases. If you cloned your git at a release point then hot patching may work, but if the git version you are using is like halfway between version X and Y then hot patching may fail. In that case either install 6.2.7.1 or do a git pull right after the release and recompile. Both require a restart.
If you run a -rc/-beta version: this is similar to a git version. Hot-patching may fail, then you will need to install 6.2.7.1 and restart the server.
Recommended today: try a test hot-patch beforehand
All fixes come out as one hot-patch which works without a restart. A great mechanism, I even published an article on my blog about this, but this aside. However, in some semi-rare cases the hot-patch command may fail, such as after a distro upgrade.
This is why we have published a TEST hot-patch. This hot-patch does not fix any particular bug. It just changes a version field in the "eos" module.
To test, you run:
Code: Select all
./unrealircd hot-patch hot-patch-test-6If something went wrong (you did not get that output) then please check out FAQ: Hot-patching failed. It contains answers for several scenarios, including the distro upgrade and compiler case.
Now you can verify that the module is actually the hot patched version. You have two options (pick one):
- On the shell you can run: ./unrealircd module-status|grep -i eos
- On IRC you can do "/MODULE -all" as an IRCOp. This outputs many lines, you will have to search for the line with eos in it (hint: use CTRL+F if your client supports it).
This means the test-patch is NOT installed: eos 5.0
If you use the IRC command then note that only IRCOps can see the version field and the "5.0" versus "5.0-hot-patch-test-6" difference. So be sure to run that command as an IRCOp. Perhaps good to know, you can also check remote servers: /MODULE -all irc2.example.net
Updates / Questions
Any updates to this pre-announcement will be here in this thread. Do you still have questions after reading this post then you can ask them here.
Unfortunately more details about the security issues will not be provided, eg: the nature, area, exact affected version range, etc. But if you have a problem or question with the test hot-patch or something else about the procedure, then feel free to ask.