CuraSec

tag: Vbulletin · 2 items

Act archived vBulletin critical pre-auth RCE flaw has public exploit
2026-07-29 · BleepingComputer · source ↗ #rce#vbulletin#public-exploit
  • Engineer — Act: Pre-auth RCE with a public exploit in vBulletin’s template renderer is actively exploitable right now — patch vBulletin to the vendor-released fixed version immediately if you run any internet-facing vBulletin instance.
  • SOC/IR — Act: A public exploit for pre-auth PHP code execution means exploitation is likely in progress — sweep vBulletin access logs for anomalous template-rendering requests and hunt for web shells or unexpected PHP processes on any vBulletin host since the disclosure date.
  • Leader — Skip
Act archived Public Exploit for vBulletin Pre-Auth RCE Now Available
2026-07-28 · The Hacker News · source ↗ #rce#vbulletin#public-exploit
  • Engineer — Act: A public exploit now makes unauthenticated code execution against vBulletin 6.2.1 and earlier trivially accessible to any attacker. Patch to the fixed release immediately; if no patch is available for your branch, take the instance offline or block external access until patched.
  • SOC/IR — Plan: With a public exploit in the wild, opportunistic scanning and exploitation attempts are likely imminent. Build or tune web application attack detections for anomalous unauthenticated POST requests to vBulletin PHP endpoints and PHP child-process spawning indicative of eval() abuse.
  • Leader — Skip