Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval function inside vBulletin and run code on an unpatched forum server. The attack needs no account, administrative access, or interaction from another user, making any internet-facing vulnerable forum a direct target. SSD Secure Disclosure lists vBulletin 6.2.1 and earlier and 6.1.6 and earlier as affected, without giving a lower version boundary. Forum software is an attractive target because it is public by design, often runs with limited maintenance, and a single compromised server can host web shells, redirect visitors, or expose community member data. Administrators should confirm their version and patch level.
A critical flaw in phpBB, the open-source forum software running on thousands of sites, lets an unauthenticated attacker obtain a valid login session as any user, including an administrator, with a single HTTP request. The bug (CVE-2026-48611, rated 9.4) works in the default configuration and traces back to code from 2014. An admin session gives full read, write, and delete access to the forum and, on the latest branch, opens a path to remote code execution and full server takeover. A second, lower-severity flaw affecting only OAuth-configured installs was also fixed. phpBB released version 3.3.17 to patch both.
TrustStrike Labs