Critical Vulnerability in b2evolution CMS Exposes Users to PHP Object Injection

• •b2evolution CMS versions 6.7.8 to 7.2.5 are vulnerable to CVE-2026-76834.
• •Attackers can exploit negative integer keys to bypass security checks.
• •Immediate action is required to mitigate potential data theft and service disruption.

b2evolution CMS versions 6.7.8 through 7.2.5 have an incomplete fix for CVE-2016-8901, allowing unauthenticated attackers to exploit the param_check_serialized_array() function. Attackers can bypass validation by using negative integer keys in serialized arrays, leading to potential code execution through crafted serialized PHP objects. This vulnerability affects all installations of b2evolution CMS, particularly those on shared hosting or with exposed administrative interfaces. The CVE-2026-76834 was published on 2026-09-17, highlighting the urgency of the issue. Users are advised to apply the vendor-supported security fix or migrate to a more secure platform. The scope of impact includes possible data theft, malware deployment, and service disruption. Current exploitation status remains unclear due to a lack of telemetry on exploitation attempts.