Loading story…
vBulletin disclosed and patched CVE-2026-61511, a critical unauthenticated remote code execution flaw in its template engine that can let attackers execute arbitrary PHP code on self-hosted forum servers. The bug affects multiple releases, including 5.x through 5.7.5 and 6.x through 6.2.1 according to advisory coverage, and is fixed in 6.2.2 with patches also issued for supported branches. The vulnerability is rooted in vB5_Template_Runtime::runMaths() in vb5/template/runtime.php, where insufficient input filtering allows attacker-controlled expressions to reach PHP's eval().
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In late June 2026, vBulletin issued patches for versions 6.2.1, 6.2.0, and 6.1.6 to address the pre-authentication remote code execution flaw later tracked as CVE-2026-61511.
On July 27, 2026, public exploit details were released for the patched vBulletin flaw, showing how attacker-controlled input through the ajax/render pagenav route could reach eval() via vB5_Template_Runtime::runMaths(). Reports noted the published proof of concept had a minor typo, but the underlying exploit path was valid when corrected.
On July 1, 2026, vBulletin released version 6.2.2 containing a fix for CVE-2026-61511, an eval injection flaw in the template runtime that can enable unauthenticated remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcegithub.com
Open sourcebleepingcomputer.com
Open sourcecryptika.com
Open sourcessd-disclosure.com
Open sourcecvefeed.io
Open sourcereddit.com
Open sourceforum.vbulletin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how attackers can abuse improperly exposed "protected" method handling in vBulletin to achieve unauthenticated remote code execution on internet-facing forums. The issue affects vBulletin `5.0.0` through `5.7.5` and `6.0.0` through `6.0.3` running on PHP `8.1` or newer, and is tracked as **CVE-2025-48827** and **CVE-2025-48828**. Technical analysis showed the flaws can be chained from remote access to protected method invocation and full code execution on vulnerable servers. CSIRT.SK reported the vulnerabilities are being actively exploited in the wild, with abuse observed since at least May 2025, while many exposed instances remain unpatched. The vendor had reportedly released fixes in April 2024 without detailed public disclosure, leaving administrators unaware of the severity until later reporting. Defenders are being urged to update affected installations to the recommended patched versions or the latest release and to review server and application logs for evidence of compromise.
Jul 24, 2026
XenForo disclosed and patched three high-severity vulnerabilities affecting multiple 2.2 and 2.3 releases, including **remote code execution**, **OAuth2 authorization abuse**, and a **template method call restriction bypass**. The most severe issue, `CVE-2026-35056`, allows an authenticated but malicious administrator with admin control panel access to execute arbitrary code on the server, affecting versions before **2.3.9** and **2.2.18**. The flaw is classified as `CWE-94` and carries a high-impact CVSS vector indicating compromise of confidentiality, integrity, and availability. Two additional XenForo flaws affect authorization controls in the platform. `CVE-2025-71278` impacts versions before **2.3.5** and allows OAuth2 client applications to request unauthorized scopes, potentially granting access beyond intended permissions; it is mapped to `CWE-863`. `CVE-2025-71281` affects versions before **2.3.7** and stems from a loose prefix match in template callback and variable method-call handling, enabling unauthorized method invocation from templates. XenForo addressed the issues in security releases **2.3.5**, **2.3.7**, **2.3.9**, and **2.2.18**, with advisories also published by VulnCheck.
Jun 29, 2026
phpBB released fixes for a critical authentication bypass flaw that lets an unauthenticated attacker obtain a valid session as any user, including administrators, by abusing the login flow and HTTP authentication handling. The issue affects phpBB versions through **3.3.16** and **4.0.0-a2**, and stems from trust in the `PHP_AUTH_USER` value when Apache-based authentication is enabled. Reports describe attackers triggering the vulnerable path with crafted requests using `login_link` and `auth_provider=apache`, causing phpBB to treat supplied credentials as authenticated under affected configurations. Researchers said compromise of an administrator account can lead to **remote code execution** and full system takeover in current phpBB deployments, turning the authentication flaw into a critical risk. phpBB addressed the bug in **3.3.17** and advised users of **4.0.0-a2** to move to the development `master` branch because no fixed 4.x release was yet available; public reporting also noted the weakness had existed since 2014 and included proof-of-concept request patterns showing how a forged login could be performed and a session retained.
Jun 29, 2026