A critical remote code execution flaw tracked as CVE-2026-61511 affects vBulletin versions 5.x up to 5.7.5 and 6.x up to 6.2.1, allowing unauthenticated attackers to execute arbitrary PHP code via template rendering. The vulnerability stems from insufficient input sanitization in the runMaths function before passing data to PHP's eval function, which can be bypassed using a technique called phpfuck. Attackers can exploit the flaw by sending specially crafted requests to the ajax/render/pagenav endpoint, with a public proof-of-concept now available online.
Security researcher Egidio Romano discovered and reported the flaw through SSD Secure Disclosure, with version 6.2.2 released on July 1, 2026, to address the issue, and patches backported to earlier 6.x releases. Users of the 5.x branch must upgrade to a newer version as no security updates will be provided for that branch. Public exploit availability typically leads to increased scanning and exploitation attempts against unpatched servers, as seen with similar vBulletin vulnerabilities in May 2025. The vBulletin platform, while losing popularity to modern solutions, still maintains significant market share across online communities and forums. Forum administrators are urged to apply updates immediately to protect against potential attacks targeting internet-facing installations. The vulnerability highlights the critical importance of proper input validation and timely security patching for PHP applications.
Read more...