Loading feed…
Latest Hacking News0 Hot0 comments5 min read
Public Exploit Lands for vBulletin’s Pre-Auth RCE, CVE-2026-61511
A public proof-of-concept exploit for CVE-2026-61511, a critical pre-authentication remote code execution vulnerability in vBulletin (CVSS 9.8), was published on July 27. The flaw resides in the vB5_Template_Runtime::runMaths() method, which passes insufficiently filtered user input to PHP's eval(). Attackers can exploit the ajax/render/pagenav endpoint without authentication using a 'phpfuck' technique — constructing executable PHP from only digits, parentheses, and operators. Affected versions include vBulletin 5.0.0 through 6.2.1; version 6.2.2 is patched. Self-hosted installs that missed the June/July patch cycle are at immediate risk. Mitigations include upgrading to 6.2.2, applying WAF rules on the pagenav[pagenumber] parameter, and reviewing access logs for exploitation attempts dating back to late June.
Source: https://latesthackingnews.com/2026/07/28/vbulletin-rce-vulnerability-cve-2026-61511. 8sync News only summarizes and links out; content copyright belongs to the authors and original sources.
