A working exploit for a critical vBulletin flaw is now circulating in the open, handing unauthenticated attackers a direct route to running PHP code on forum servers — no account, no login required. The uncomfortable part: the fix has been sitting on vBulletin's patch server for nearly a month, so any administrator who skipped it is now racing a public proof-of-concept. Tracked as <b> CVE-2026-61511</b> , the pre-authentication remote code execution flaw was reported by a researcher working with SSD Secure Disclosure. The released exploit carries the handle "EgiX" — Egidio Romano, the same researcher behind vBulletin's 2025 template-engine code-execution chain. In other words, the person who burned the platform last year is back.  The bug lives in the runMaths() method inside /includes/vb5/template/runtime.php , which handles the {vb:math} template tag. Before passing an expression to PHP's eval() function, the code runs a regex filter meant to strip anything dangerous — but…
