Loading story…
phpBB released fixes for a critical authentication bypass flaw that lets an unauthenticated attacker obtain a valid session as any user, including administrators, by abusing the login flow and HTTP authentication handling. The issue affects phpBB versions through 3.3.16 and 4.0.0-a2, and stems from trust in the PHP_AUTH_USER value when Apache-based authentication is enabled. Reports describe attackers triggering the vulnerable path with crafted requests using login_link and auth_provider=apache, causing phpBB to treat supplied credentials as authenticated under affected configurations.
Researchers said compromise of an administrator account can lead to remote code execution and full system takeover in current phpBB deployments, turning the authentication flaw into a critical risk. phpBB addressed the bug in 3.3.17 and advised users of 4.0.0-a2 to move to the development master branch because no fixed 4.x release was yet available; public reporting also noted the weakness had existed since 2014 and included proof-of-concept request patterns showing how a forged login could be performed and a session retained.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Aikido publicly disclosed the phpBB vulnerability, describing an unauthenticated one-request login bypass that could lead to remote code execution if an administrator account is compromised. The disclosure noted the issue was exploitable in the default configuration and that some technical details were being temporarily withheld to allow time for patching.
phpBB released version 3.3.17 to fix the authentication bypass issue. Users of 4.0.0-a2 were advised to upgrade to master because no safe 4.x release was yet available.
Aikido reported a critical authentication bypass vulnerability in phpBB to the phpBB maintainers via HackerOne. The report said the flaw affected versions up to and including 3.3.16 and 4.0.0-a2 and could allow unauthenticated access as any user.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
aikido.dev
Open sourcephpbb.com
Open sourceopennet.ru
Open sourceopennet.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
phpBB has fixed a long-standing authentication bypass vulnerability that lets attackers log in as any forum user, including administrators, with a single HTTP request. The flaw, discovered by Aikido and reported through phpBB’s HackerOne disclosure program, affects phpBB `3.3.16` and earlier as well as `4.0.0-a2`, spans both the 3.x and 4.x branches, and reportedly existed for about 10 years. Researchers said the bug requires no special configuration and can be exploited against default deployments. Successful exploitation could allow attackers to read private messages, manipulate forum content and user accounts, impersonate moderators or administrators, and deface forums. phpBB released a fix for the 3.x branch in version `3.3.17`, while no patched 4.x release was available at the time of reporting. Aikido withheld technical details to give administrators time to update and separately warned operators of large phpBB forums; researchers also noted that remote code execution is not possible because the Admin Control Panel enforces a separate password check.
Jul 3, 2026
Researchers detailed how attackers can abuse improperly exposed "protected" method handling in vBulletin to achieve unauthenticated remote code execution on internet-facing forums. The issue affects vBulletin `5.0.0` through `5.7.5` and `6.0.0` through `6.0.3` running on PHP `8.1` or newer, and is tracked as **CVE-2025-48827** and **CVE-2025-48828**. Technical analysis showed the flaws can be chained from remote access to protected method invocation and full code execution on vulnerable servers. CSIRT.SK reported the vulnerabilities are being actively exploited in the wild, with abuse observed since at least May 2025, while many exposed instances remain unpatched. The vendor had reportedly released fixes in April 2024 without detailed public disclosure, leaving administrators unaware of the severity until later reporting. Defenders are being urged to update affected installations to the recommended patched versions or the latest release and to review server and application logs for evidence of compromise.
Jul 24, 2026
High-severity vulnerabilities have been disclosed for **PhreeBooks ERP 5.2.3** and **phpBB**, both allowing authenticated attackers to turn file upload functionality into remote code execution. In **CVE-2019-25630**, an attacker can abuse the `imgFile` parameter in the `bizuno/image/manager` endpoint to upload a malicious PHP file and then execute it through `bizunoFS.php`. The issue affects the Image Manager component in PhreeBooks ERP and was rated high impact under both CVSS v3.1 and v4.0. A separate flaw, **CVE-2019-25685**, affects phpBB and uses `plupload` together with the `phar://` stream wrapper to upload a crafted ZIP archive containing serialized PHP objects. When those objects are later deserialized via the `imagick` parameter in attachment settings, arbitrary code can be executed on the server. References tied to the disclosures include **Exploit-DB** and **VulnCheck**, indicating public technical detail is available for both upload-to-RCE attack paths.
Jun 29, 2026