Public-Exploit on CuraSec

vBulletin critical pre-auth RCE flaw has public exploit

Wed, 29 Jul 2026 13:07:14 +0000

Engineer — Act: Pre-auth RCE with a public exploit in vBulletin’s template renderer is actively exploitable right now — patch vBulletin to the vendor-released fixed version immediately if you run any internet-facing vBulletin instance.
SOC/IR — Act: A public exploit for pre-auth PHP code execution means exploitation is likely in progress — sweep vBulletin access logs for anomalous template-rendering requests and hunt for web shells or unexpected PHP processes on any vBulletin host since the disclosure date.
Leader — Skip

Tue, 28 Jul 2026 13:01:43 +0000

Engineer — Act: A public exploit now makes unauthenticated code execution against vBulletin 6.2.1 and earlier trivially accessible to any attacker. Patch to the fixed release immediately; if no patch is available for your branch, take the instance offline or block external access until patched.
SOC/IR — Plan: With a public exploit in the wild, opportunistic scanning and exploitation attempts are likely imminent. Build or tune web application attack detections for anomalous unauthenticated POST requests to vBulletin PHP endpoints and PHP child-process spawning indicative of eval() abuse.
Leader — Skip

Sun, 19 Jul 2026 12:05:51 +0000

Engineer — Act: Public exploits for critical WordPress Core RCE make this urgent regardless of absent KEV/EPSS data — update WordPress Core to the latest patched release immediately and verify any managed hosting environments are also updated.
SOC/IR — Plan: No IOCs or TTPs are provided to hunt on now, but given public exploits exist for a widely-deployed web platform, build or tune detections for WordPress exploit traffic (e.g., anomalous POST patterns, webshell indicators in web access logs) before active campaigns arrive.
Leader — Plan: This is an engineering-track issue, not board-level — confirm your team has inventoried WordPress instances across the estate and that patching is tracked to completion this week.