A public proof-of-concept exploit for CVE-2026-61511, a critical pre-authentication remote code execution vulnerability in vBulletin (CVSS 9.8), was published on July 27. The flaw resides in the `vB5_Template_Runtime::runMaths()` method, which passes insufficiently filtered user input to PHP's `eval()`. Attackers can exploit the `ajax/render/pagenav` endpoint without authentication using a 'phpfuck' technique — constructing executable PHP from only digits, parentheses, and operators. Affected versions include vBulletin 5.0.0 through 6.2.1; version 6.2.2 is patched. Self-hosted installs that missed the June/July patch cycle are at immediate risk. Mitigations include upgrading to 6.2.2, applying WAF rules on the `pagenav[pagenumber]` parameter, and reviewing access logs for exploitation attempts dating back to late June.
