vBulletin zero-day: patch your forum now
A pre-login remote code bug in vBulletin was published without warning, and a patch is out. Forums are under attack.
On Monday someone published, anonymously and with no warning to the vendor, a working exploit for vBulletin, the forum software used by many large communities. The bug (CVE-2019-16759) lets anyone run commands on the server without logging in. Versions 5.0.0 to 5.5.4 are affected.
vBulletin released patches yesterday. Attacks started almost immediately.
- Apply the patch for your version, or take the forum offline until you can.
- Check for signs of compromise: new files in the web folder, new admin accounts, unusual processes.
- Assume the user database may be exposed if you were hit, and tell your members.
Many forums are run by volunteers on old servers. If you run one, set up update notifications for your software. Someone else is watching it closely.