Critical vBulletin Flaw Lets Unauthenticated Attackers Execute PHP Code Remotely

Cybersecuritynews •Abinaya • July 27, 2026

vBulletin has patched CVE-2026-61511, a critical remote code execution flaw that could let unauthenticated attackers execute arbitrary PHP code and compromise vulnerable forum servers. This issue affects vBulletin versions 6.2.1 and earlier as well as versions 6.1.6 and earlier. The flaw exists in the file /includes/vb5/template/runtime.php, specifically within the vB5_Template_Runtime::runMaths() method. This function processes values […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical vBulletin RCE Flaw Exposes Forum Servers to Unauthenticated Attacks A critical remote code execution vulnerability, tracked as CVE-2026-61511, has been disclosed in vBulletin, allowing unauthenticated attackers to execute arbitrary PHP code on vulnerable forum servers. The flaw affects vBulletin versions 6.2.1 and earlier, as well as 6.1.6 and earlier. It exists in the vB5_Template_Runtime::runMaths() method within the runtime.php file. Public exploit details have been released, showing how attackers can reach PHP's eval() function without needing any user interaction. This vulnerability poses a significant risk to unpatched forum installations, as it does not require administrative access. The vulnerability was disclosed by SSD Secure Disclosure on July 27, 2026, and a patch has been issued to mitigate the risk. Administrators are urged to apply the patch immediately to protect their systems. 11 sources 73

Extracted Entities

Critical vBulletin Flaw Lets Unauthenticated Attackers Execute PHP Code Remotely

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)