vBulletin Breach Prompts Password Reset
Summary: vBulletin urged users to change passwords after attackers accessed customer IDs and encrypted passwords on its systems, with the company saying it found no zero-day flaws in current software. The attackers claimed a vBulletin 4.x/5.x zero-day and tied it to breaches of vbulletin.com and macrumors.com, though MacRumors owner Arnold Kim said his site runs version 3.x and was hit through a cross-site-scripting attack using a compromised moderator account whose same name and password also existed on vBulletin.com.
What you should know: The claimed exploit was advertised for $7,000 in Bitcoin, then offered for $200, and at least one buyer sent 15 Bitcoins on Nov. 15 - a reminder that a single reused moderator password, not the software version, was the entry point here.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026