Critical vBulletin Vulnerability Lets Unauthenticated Attackers Execute Remote PHP Code

A critical remote code execution vulnerability has been disclosed in vBulletin, one of the most widely used forum software platforms , allowing unauthenticated attackers to execute arbitrary PHP code on affected servers without any user interaction or credentials. Tracked as CVE-2026-61511, the flaw was identified by an independent security researcher working with SSD Secure Disclosure and publicly disclosed on July 27, 2026. The vulnerability affects vBulletin 6.2.1 and…