Loading story…
phpBB has fixed a long-standing authentication bypass vulnerability that lets attackers log in as any forum user, including administrators, with a single HTTP request. The flaw, discovered by Aikido and reported through phpBB’s HackerOne disclosure program, affects phpBB 3.3.16 and earlier as well as 4.0.0-a2, spans both the 3.x and 4.x branches, and reportedly existed for about 10 years. Researchers said the bug requires no special configuration and can be exploited against default deployments.
Successful exploitation could allow attackers to read private messages, manipulate forum content and user accounts, impersonate moderators or administrators, and deface forums. phpBB released a fix for the 3.x branch in version 3.3.17, while no patched 4.x release was available at the time of reporting. Aikido withheld technical details to give administrators time to update and separately warned operators of large phpBB forums; researchers also noted that remote code execution is not possible because the Admin Control Panel enforces a separate password check.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Aikido disclosed a roughly 10-year-old phpBB authentication bypass affecting versions 3.3.16 and earlier and 4.0.0-a2. The researchers said exploitation requires no special configuration and works against default deployments, but withheld technical details while warning large forum operators directly.
phpBB released version 3.3.17 to patch the authentication bypass vulnerability in the 3.x branch. At the time of reporting, no fix was yet available for the affected 4.x branch.
Aikido published a technical write-up for CVE-2026-48611 explaining that phpBB's login-link flow could be abused by selecting the apache auth provider, enabling login as any user with a single request. The post included proof-of-concept requests and advised defenders to review logs for suspicious mode=login_link and auth_provider=apache combinations, including POST-overrides-GET variants.
phpBB received Aikido's report of a long-standing authentication bypass vulnerability through its HackerOne vulnerability disclosure program. The flaw allows login as any forum user, including administrators, with a single HTTP request.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcexakep.ru
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceaikido.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
phpBB released fixes for a critical authentication bypass flaw that lets an unauthenticated attacker obtain a valid session as any user, including administrators, by abusing the login flow and HTTP authentication handling. The issue affects phpBB versions through **3.3.16** and **4.0.0-a2**, and stems from trust in the `PHP_AUTH_USER` value when Apache-based authentication is enabled. Reports describe attackers triggering the vulnerable path with crafted requests using `login_link` and `auth_provider=apache`, causing phpBB to treat supplied credentials as authenticated under affected configurations. Researchers said compromise of an administrator account can lead to **remote code execution** and full system takeover in current phpBB deployments, turning the authentication flaw into a critical risk. phpBB addressed the bug in **3.3.17** and advised users of **4.0.0-a2** to move to the development `master` branch because no fixed 4.x release was yet available; public reporting also noted the weakness had existed since 2014 and included proof-of-concept request patterns showing how a forged login could be performed and a session retained.
Jun 29, 2026
Researchers detailed how attackers can abuse improperly exposed "protected" method handling in vBulletin to achieve unauthenticated remote code execution on internet-facing forums. The issue affects vBulletin `5.0.0` through `5.7.5` and `6.0.0` through `6.0.3` running on PHP `8.1` or newer, and is tracked as **CVE-2025-48827** and **CVE-2025-48828**. Technical analysis showed the flaws can be chained from remote access to protected method invocation and full code execution on vulnerable servers. CSIRT.SK reported the vulnerabilities are being actively exploited in the wild, with abuse observed since at least May 2025, while many exposed instances remain unpatched. The vendor had reportedly released fixes in April 2024 without detailed public disclosure, leaving administrators unaware of the severity until later reporting. Defenders are being urged to update affected installations to the recommended patched versions or the latest release and to review server and application logs for evidence of compromise.
Jul 24, 2026
A high-severity vulnerability tracked as **CVE-2026-66398** affects **phpMyFAQ** versions before **4.1.6**, allowing authenticated remote code execution through the application's configuration API. The flaw requires an administrator account with the `CONFIGURATION_EDIT` and `ATTACHMENT_ADD` privileges, and stems from unsafe handling of the `upgrade.lastDownloadedPackage` setting during the update process. An attacker can exploit the issue by uploading a malicious ZIP archive as an attachment, repointing the updater configuration to that stored file path, and triggering extraction into the application root so arbitrary PHP files are written and executed. Successful exploitation yields code execution as the web server user, with reported impact spanning confidentiality, integrity, and availability; **phpMyFAQ 4.1.6** is listed as unaffected.
Jul 28, 2026