Forums Security Report
Posted: Mon Jul 20, 2026 8:17 pm
Hello everyone,
We would like to give a report of a security breach we had on this forums. Fortunately, it was a small event, and there has been no serious damage - like access to sensitive data.
Still, it is important to properly report such incidents. Furthermore, it is a nice example to talk about cybersecurity, which you hear a lot about in the news but rarely get a practical insight into.
Background:
In early June, some security team reported a vulnerability in the phpBB forum software, which was registered as CVE-2026-48611
See the full description here: https://pentest-tools.com/research/phpb ... ion-bypass
(the article mentions a second CVE, but this is not specific to our case.)
The phpBB team fixed it on June 6 before it was publicly disclosed on June 8, and finally proof-of-concept details published on July 4.
Unfortunately, we did not notice and install this update quickly. We didn't yet set up an extension to send notifications when updates are available, and only very recently I had installed the latest update. For comparison, between previous phpBB releases there was a little over 1 year, so I did not expect a new version any time soon.
What does this CVE mean:
The bug was that anyone could gain access to any user account with one simple http-request. The only thing an attacker needed to know was a valid user name - preferably an admin account.
A note about phpBB
To better understand the details given below, a little explanation how an installation of phpBB is set up, beyond what you see as a regular user:
phpBB, as the name suggests, is written in the php scripting language. On the webserver, there are hence bunch of php files that make up the functionality and design of the website and all its features.
The data itself, i.e. user accounts, (hashed) passwords, messages, etc. are stored in an SQL-database.
The website itself features the regular view that you see as users, as well as special User-, Moderator-, and Admin-"control panels" (UCP, MCP, ACP). As the names suggest, these are only available to the specific groups. The ACP is of course the most powerful, but also specially protected, requiring a re-authentication (a second login, using the same password).
For our case, the UCP and ACP are relevant.
The ACP allows admins to do things like configure the board settings, activate/deactivate extensions and make some configurations, change permissions and forum rules, assign new passwords or delete accounts.
In contrast, what you can not do through the ACP is to install or update the phpBB-software, install or update extensions, or get a direct access to the SQL-database. All of this requires direct login to the webhosting.
What damage can be done
A question to consider is what damage can even be done on a phBB-forum. This is the list we came up with for our case:
- Delete messages or user accounts, lock out people from their accounts
- Edit messages to contain spam
- Edit messages with hyperlinks to point to malicious sites
- Access sensitive data, here: email addresses, private messages (DMs), IP addresses.
What happened on the LuxCoreRender forums
Now, let me describe the series of events in detail:
On July 9, during a routine check I noticed that our top-level admin account had been logged into, and that two new admin accounts had been created. All of this had happened on July 8 within a window of a few hours.
Initially, it was obvious the attackers did two things:
1) Reactivate two old extensions: Discord notifications and VigLink (which is for affiliate links). We don't use either of these. Discord integration had probably only been tested many years ago. VigLink ships with phpBB, but we don't use it.
2) They allowed a new file extension type (like .zip or .exe) for uploads: "http://www.baidu.com". This does not make sense as a file extension at first glance, but as far as I learned it is part of "remote file inclusion" attacks or something similar.
Immediate countermeasures:
The first actions after this was noticed were to
- change the password of the admin account
- delete the newly created accounts
- update phpBB
- revert the changes made by the attackers
Deeper analysis:
The countermeasures mentioned above fixed the vulnerability to prevent further incidents. But we still needed to check if there were any more serious consequences, i.e.:
- Have the attackers used the admin access to obtain sensitive data?
- Has a remote file inclusion actually been executed?
To check this, we looked into the SQL database of the forums, as well as log files of the webserver. The files on our webhosting were also checked using antivirus scanner. @nocivo and I did this independently, and fortunately arrived at the same conclusions.
We looked at the logs starting June 8, when the vulnerability was disclosed. The vulnerability uses a single, very specific http-request, so we looked for all occurrences of this.
Result: In addition to July 8, there were matches for June 23 and July 7. In both of those cases, there were no further requests from those IPs, so the vulnerability was not exploited. My personal guess would be those were automated systems charting affected servers.
On July 8, the main event, the total number of http-requests from the malicious IP addresses was around 150, which is actually low enough to go through everything individually. These requests were quite specific and immediately accessed relevant sites, like the members list reduced to the group of admin users. This suggests the attack was also done by an automated system.
The logs did not show access to the full user list, any individual profiles, or actual threads/messages. This would have been where individual email addresses etc. would have been visible. Hence we can conclude that no sensitive data was retrieved.
Some seemingly random parts of the admin control panel were also accessed, without any changes applied. What they may have been looking for, we do not know.
The whole incident took place over a period of approx. 3 hours. Between that and discovery a day later, no further access by the attackers was registered.
The vulnerability itself only allowed to login to the main forums, not the Admin Control Panel (ACP), which requires re-authentication as I mentioned above. The same bug did not work for the ACP.
The fact that the attackers still were able to gain access to the ACP was due to another default setting: Admins could make another users admin without access to the ACP via the UCP!
This feature has now been deactivated to close that loophole.
The logs did not show any redirect to an external website, i.e. no indication that a "remote file inclusion" etc. had been executed.
Summary - Reasons and Actions:
The incident was short and only executed very specifics functions, creating new admin account and changing extension settings.
The conclusion from this would be that this was an automated system placing backdoors and other vulnerabilities that could have been exploited during the next phase.
The attack was made possible by the combination of the following factors ("Swiss Cheese Model"):
- An underlying severe bug in phpBB
- Too rare checks for updates from our side, missing the latest update for a few weeks.
- A default setting in phpBB allowing to promote users to admin without ACP login
As a result and lessons learned, we have implemented - or are in progress of setting up - the following:
- Be more thorough in uninstalling unused extensions.
- Double check for access points like the UCP.
- Limit the number of users with admin rights (it was still given to former devs who have not logged into their account for years.)
- Install features to notify us when updates are available.
- Check if we can reduce the amount of sensitive data stored on our systems.
Follow up DDOS event
A few days after this event, and while we were still writing and checking this report, the forums were hit by a layer 7 DDOS attack. It did not completely break down the system, but access to the forums was sometimes interrupted.
Again, we analyzed the logs and found no evidence of any additional successful hacking or attempted exploits. There was only the usual background noise you always have on any server (random login attempts with common passwords known from generic leaks, for example).
@nocivo has already activated some additional protections. Of course, we will continue to monitor this, too.
We hope this report was helpful and interesting to you, and that it shows we take this topic seriously.
Greetings from the webhosting team.
We would like to give a report of a security breach we had on this forums. Fortunately, it was a small event, and there has been no serious damage - like access to sensitive data.
Still, it is important to properly report such incidents. Furthermore, it is a nice example to talk about cybersecurity, which you hear a lot about in the news but rarely get a practical insight into.
Background:
In early June, some security team reported a vulnerability in the phpBB forum software, which was registered as CVE-2026-48611
See the full description here: https://pentest-tools.com/research/phpb ... ion-bypass
(the article mentions a second CVE, but this is not specific to our case.)
The phpBB team fixed it on June 6 before it was publicly disclosed on June 8, and finally proof-of-concept details published on July 4.
Unfortunately, we did not notice and install this update quickly. We didn't yet set up an extension to send notifications when updates are available, and only very recently I had installed the latest update. For comparison, between previous phpBB releases there was a little over 1 year, so I did not expect a new version any time soon.
What does this CVE mean:
The bug was that anyone could gain access to any user account with one simple http-request. The only thing an attacker needed to know was a valid user name - preferably an admin account.
A note about phpBB
To better understand the details given below, a little explanation how an installation of phpBB is set up, beyond what you see as a regular user:
phpBB, as the name suggests, is written in the php scripting language. On the webserver, there are hence bunch of php files that make up the functionality and design of the website and all its features.
The data itself, i.e. user accounts, (hashed) passwords, messages, etc. are stored in an SQL-database.
The website itself features the regular view that you see as users, as well as special User-, Moderator-, and Admin-"control panels" (UCP, MCP, ACP). As the names suggest, these are only available to the specific groups. The ACP is of course the most powerful, but also specially protected, requiring a re-authentication (a second login, using the same password).
For our case, the UCP and ACP are relevant.
The ACP allows admins to do things like configure the board settings, activate/deactivate extensions and make some configurations, change permissions and forum rules, assign new passwords or delete accounts.
In contrast, what you can not do through the ACP is to install or update the phpBB-software, install or update extensions, or get a direct access to the SQL-database. All of this requires direct login to the webhosting.
What damage can be done
A question to consider is what damage can even be done on a phBB-forum. This is the list we came up with for our case:
- Delete messages or user accounts, lock out people from their accounts
- Edit messages to contain spam
- Edit messages with hyperlinks to point to malicious sites
- Access sensitive data, here: email addresses, private messages (DMs), IP addresses.
What happened on the LuxCoreRender forums
Now, let me describe the series of events in detail:
On July 9, during a routine check I noticed that our top-level admin account had been logged into, and that two new admin accounts had been created. All of this had happened on July 8 within a window of a few hours.
Initially, it was obvious the attackers did two things:
1) Reactivate two old extensions: Discord notifications and VigLink (which is for affiliate links). We don't use either of these. Discord integration had probably only been tested many years ago. VigLink ships with phpBB, but we don't use it.
2) They allowed a new file extension type (like .zip or .exe) for uploads: "http://www.baidu.com". This does not make sense as a file extension at first glance, but as far as I learned it is part of "remote file inclusion" attacks or something similar.
Immediate countermeasures:
The first actions after this was noticed were to
- change the password of the admin account
- delete the newly created accounts
- update phpBB
- revert the changes made by the attackers
Deeper analysis:
The countermeasures mentioned above fixed the vulnerability to prevent further incidents. But we still needed to check if there were any more serious consequences, i.e.:
- Have the attackers used the admin access to obtain sensitive data?
- Has a remote file inclusion actually been executed?
To check this, we looked into the SQL database of the forums, as well as log files of the webserver. The files on our webhosting were also checked using antivirus scanner. @nocivo and I did this independently, and fortunately arrived at the same conclusions.
We looked at the logs starting June 8, when the vulnerability was disclosed. The vulnerability uses a single, very specific http-request, so we looked for all occurrences of this.
Result: In addition to July 8, there were matches for June 23 and July 7. In both of those cases, there were no further requests from those IPs, so the vulnerability was not exploited. My personal guess would be those were automated systems charting affected servers.
On July 8, the main event, the total number of http-requests from the malicious IP addresses was around 150, which is actually low enough to go through everything individually. These requests were quite specific and immediately accessed relevant sites, like the members list reduced to the group of admin users. This suggests the attack was also done by an automated system.
The logs did not show access to the full user list, any individual profiles, or actual threads/messages. This would have been where individual email addresses etc. would have been visible. Hence we can conclude that no sensitive data was retrieved.
Some seemingly random parts of the admin control panel were also accessed, without any changes applied. What they may have been looking for, we do not know.
The whole incident took place over a period of approx. 3 hours. Between that and discovery a day later, no further access by the attackers was registered.
The vulnerability itself only allowed to login to the main forums, not the Admin Control Panel (ACP), which requires re-authentication as I mentioned above. The same bug did not work for the ACP.
The fact that the attackers still were able to gain access to the ACP was due to another default setting: Admins could make another users admin without access to the ACP via the UCP!
This feature has now been deactivated to close that loophole.
The logs did not show any redirect to an external website, i.e. no indication that a "remote file inclusion" etc. had been executed.
Summary - Reasons and Actions:
The incident was short and only executed very specifics functions, creating new admin account and changing extension settings.
The conclusion from this would be that this was an automated system placing backdoors and other vulnerabilities that could have been exploited during the next phase.
The attack was made possible by the combination of the following factors ("Swiss Cheese Model"):
- An underlying severe bug in phpBB
- Too rare checks for updates from our side, missing the latest update for a few weeks.
- A default setting in phpBB allowing to promote users to admin without ACP login
As a result and lessons learned, we have implemented - or are in progress of setting up - the following:
- Be more thorough in uninstalling unused extensions.
- Double check for access points like the UCP.
- Limit the number of users with admin rights (it was still given to former devs who have not logged into their account for years.)
- Install features to notify us when updates are available.
- Check if we can reduce the amount of sensitive data stored on our systems.
Follow up DDOS event
A few days after this event, and while we were still writing and checking this report, the forums were hit by a layer 7 DDOS attack. It did not completely break down the system, but access to the forums was sometimes interrupted.
Again, we analyzed the logs and found no evidence of any additional successful hacking or attempted exploits. There was only the usual background noise you always have on any server (random login attempts with common passwords known from generic leaks, for example).
@nocivo has already activated some additional protections. Of course, we will continue to monitor this, too.
We hope this report was helpful and interesting to you, and that it shows we take this topic seriously.
Greetings from the webhosting team.