In short: On 27 July 2026, researchers published a working exploit for a critical flaw in vBulletin, one of the most widely used forum engines. Tracked as CVE-2026-61511 and rated 9.8 out of 10 on CVSS 3.1, it lets an attacker run arbitrary PHP code on a forum server without any login. A patch has existed since 1 July (version 6.2.2), but every unpatched forum is now an easy target — and with it, the accounts, emails and private messages of everyone registered there. If you use forums, assume some may be breached and protect your accounts accordingly.
What happened
On 27 July 2026, SSD Secure Disclosure published the technical details and a proof-of-concept for CVE-2026-61511, a pre-authentication remote code execution vulnerability in the vBulletin forum platform. "Pre-authentication" is the dangerous part: an attacker does not need an account, a password or any access at all — a single specially crafted request is enough to take over the server. The flaw carries a CVSS 3.1 score of 9.8, near the maximum.
vBulletin developers had actually fixed the bug earlier: version 6.2.2 shipped on 1 July, with backported patches for 6.2.1, 6.2.0 and 6.1.6 at the end of June. But a public exploit changes the risk overnight — it lowers the barrier so far that mass scanning and automated attacks against unpatched forums typically follow within days. Any forum admin who skipped the update is now exposed. This echoes the archiver flaws we recently covered, such as the RCE hole in WinRAR: a fix exists, but unpatched installations stay wide open.
Why the flaw is so severe
The bug lives in how vBulletin evaluates math expressions inside its templates. A filter is supposed to strip anything but digits, brackets and arithmetic operators before the expression is handed to PHP's eval() function. But the filter only removes letters — so a crafted input can reconstruct function names without using letters directly and smuggle commands through to eval(). The result is code execution on the server, reached through the public ajax/render endpoint with nothing more than a manipulated page number.
The 5.x branch (up to 5.7.5) and the 6.x branch (up to 6.2.1) are affected. Notably, vBulletin has said the 5.x line will not receive a fix for this issue, so forums still on version 5 cannot simply patch — they need to upgrade or migrate. As of the disclosure, no confirmed in-the-wild attacks were reported, but that window rarely stays open for long once an exploit is public.
What it means for you as an ordinary user
You may not run a forum, but you almost certainly have accounts on several — hobby communities, tech boards, game and software forums, support sites. Many of them run vBulletin. If one is compromised through this flaw, attackers can reach its database: your username, email address, hashed password and, on many forums, your private messages and IP history.
The real danger is password reuse. If the password from a breached forum matches the one on your email or bank, attackers will try it everywhere — a technique called credential stuffing. That is exactly how a single niche-forum breach can cascade into hijacked email and financial accounts, the same pattern we described in the billion-record credential leak. Our guide on protecting accounts from hijacking covers the warning signs of a compromised account.
How to protect your data
Use a unique password for every site. This is the single most effective defence: if a forum leaks, the damage stops there. A password manager makes unique passwords practical across dozens of accounts.
Turn on two-factor authentication wherever it is offered, especially on email and banking. Even a leaked password is far less useful to an attacker without the second factor.
If you run a vBulletin forum, patch now. Update to 6.2.2 or apply the Patch Level 1 backport for your branch; forums on the 5.x line should plan an upgrade, since no fix is coming for version 5. Restrict access to the admin panel and keep it off the open internet — reaching it through a VPN rather than exposing it publicly reduces the attack surface.
Encrypt your connection on untrusted networks. A VPN does not patch a server-side flaw — only the update does that. But it protects a different layer: on public or shared Wi-Fi it routes your traffic through an encrypted tunnel, so others on the same network cannot intercept the logins and session cookies you send to sites. LiMP VPN is a no-logs service for iOS and Android — see the features and plans, and more security news on our blog.
How do I know if a forum I use was affected?
You usually cannot tell from the outside, and forum owners do not always disclose breaches. The safe assumption is that any account could be exposed. Rather than trying to audit each site, focus on what you control: give every forum its own password, enable two-factor authentication on the accounts that matter most, and change reused passwords now. If a forum later announces a breach, change that password immediately and anywhere else you reused it.
Sources
This report is based on coverage by BleepingComputer and the Russian security outlet SecurityLab, both July 2026, referencing the technical disclosure by SSD Secure Disclosure.