Loading story…
Attackers actively exploited CVE-2020-17496, a pre-authentication remote code execution flaw in vBulletin, to run arbitrary PHP code on vulnerable forums. The bug bypassed the earlier fix for CVE-2019-16759 by abusing vBulletin’s template rendering logic, specifically the widget_tabbedcontainer_tab_panel template to indirectly invoke widget_php. Palo Alto Networks Unit 42 reported exploitation beginning shortly after disclosure, with multiple unrelated actors scanning for exposed systems and attempting remote command execution.
Observed attacks included reading sensitive files such as /etc/passwd, writing PHP web shells, and delivering additional malware. Unit 42 said intruders used the vulnerability to download a Perl-based Shellbot and a Mirai variant known as Sora, underscoring the risk of both persistent compromise and botnet recruitment. vBulletin issued a patch for affected versions, and organizations running the software were urged to update immediately because of the broad installed base and ongoing exploitation.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Unit 42 observed the first exploitation of CVE-2020-17496 in the wild on Aug. 10, 2020. Multiple unrelated attackers used the flaw for scanning, command execution, file reading, web shell deployment, and malware delivery.
vBulletin released a patch for the pre-authentication remote code execution vulnerability CVE-2020-17496 on Aug. 10, 2020. The flaw bypassed the earlier fix for CVE-2019-16759.
A remote code execution vulnerability tracked as CVE-2019-16759 was disclosed for vBulletin in September 2019. CVE-2020-17496 was later described as a bypass of the fix for this earlier flaw.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 41 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourceunit42.paloaltonetworks.com
Open sourcecve.mitre.org
Open sourceblog.exploitee.rs
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how attackers can abuse improperly exposed "protected" method handling in vBulletin to achieve unauthenticated remote code execution on internet-facing forums. The issue affects vBulletin `5.0.0` through `5.7.5` and `6.0.0` through `6.0.3` running on PHP `8.1` or newer, and is tracked as **CVE-2025-48827** and **CVE-2025-48828**. Technical analysis showed the flaws can be chained from remote access to protected method invocation and full code execution on vulnerable servers. CSIRT.SK reported the vulnerabilities are being actively exploited in the wild, with abuse observed since at least May 2025, while many exposed instances remain unpatched. The vendor had reportedly released fixes in April 2024 without detailed public disclosure, leaving administrators unaware of the severity until later reporting. Defenders are being urged to update affected installations to the recommended patched versions or the latest release and to review server and application logs for evidence of compromise.
Jul 24, 2026
vBulletin disclosed and patched **CVE-2026-61511**, a critical unauthenticated remote code execution flaw in its template engine that can let attackers execute arbitrary PHP code on self-hosted forum servers. The bug affects multiple releases, including **5.x through 5.7.5** and **6.x through 6.2.1** according to advisory coverage, and is fixed in **6.2.2** with patches also issued for supported branches. The vulnerability is rooted in `vB5_Template_Runtime::runMaths()` in `vb5/template/runtime.php`, where insufficient input filtering allows attacker-controlled expressions to reach PHP's `eval()`.
Jul 29, 2026
Attackers began exploiting **Oracle WebLogic Server** vulnerability `CVE-2026-21962` almost immediately after public proof-of-concept code was posted, according to observations from a high-interaction honeypot emulating an unpatched **WebLogic Server 14.1.1.0.0** instance. The flaw is a **CVSS 10.0** unauthenticated remote code execution issue in the WebLogic Console, and researchers recorded active exploitation attempts over a 12-day period, showing how quickly newly disclosed enterprise software vulnerabilities can be operationalized. The activity was largely automated and opportunistic, with scans and exploit attempts originating mainly from rented VPS infrastructure including **DigitalOcean** and **HOSTGLOBAL.PLUS**. Researchers also observed continued abuse of older WebLogic flaws such as `CVE-2020-14882`, `CVE-2020-14883`, `CVE-2020-2551`, and `CVE-2017-10271`, alongside probes for unrelated weaknesses in **Hikvision** devices and **PHPUnit**, indicating a broad spray-and-pray campaign. Common tooling included **libredtail-http** and the **Nmap Scripting Engine**, while defenders were urged to apply Oracle patches, restrict internet exposure of the administrative console, deploy a **WAF**, and monitor for suspicious activity including `wget` or `curl` execution.
Jun 29, 2026