Public exploit details released on July 27 show how an
unauthenticated request can reach PHP's eval() function inside
vBulletin and execute code on an unpatched forum server. The attack
requires no account, administrative access, or interaction from
another user. SSD Secure Disclosure lists vBulletin 6.2.1 and
earlier, and 6.1.6 and earlier, as affected, but does not give a
lower version
Read more https://thehackernews.com/2026/07/public-exploit-released-for-patched.html
