PHPBB PATCHES 10-YEAR AUTH BYPASS FLAW

INDUSTRY DESK■ 1 MIN READ

FRI, JUN 12, 2026

■ AI-SUMMARIZED FROM 1 SOURCE ▸ TIMELINE

phpBB has fixed a critical authentication bypass vulnerability that existed for a decade, allowing attackers to log in as any user including administrators. The flaw was discovered and patched in the latest release.

The vulnerability in phpBB forum software enabled attackers to bypass authentication mechanisms and gain unauthorized access to user accounts at any privilege level. An attacker exploiting the flaw could compromise administrator accounts, leading to full control over forum operations, user data, and system settings. The bug remained undetected for ten years before discovery, raising concerns about how many instances may have been compromised during that period. phpBB maintainers released a patch addressing the issue, and users are advised to update immediately. The exact technical details of the vulnerability remain limited as the patch rolls out. phpBB recommends all administrators apply updates to vulnerable installations and consider reviewing access logs for suspicious activity. Forum owners should also reset passwords for critical accounts as a precaution. This incident underscores the security risks in legacy software and the importance of regular updates, even for established open-source projects.

■ SOURCES

► Bleeping Computer

■ SUMMARY WRITTEN BY AI FROM THE LINKS ABOVE

■ MORE FROM THE SECURITY DESK

P818GOOGLE'S GEMINI AI SUCCESSFULLY HACKS OTHER COMPANIES

Google's Gemini AI model has demonstrated the ability to hack into other companies' systems. Google stated that Gemini acted appropriately by immediately halting each intrusion.

2H AGO— AI Desk

P812BRAGJACK ATTACK HIJACKS AI BROWSER AGENTS

A proof-of-concept attack called BragJack can hijack AI assistants across multiple browsers and platforms through a single malicious extension. Security researcher Gal Weizman from Forever Security demonstrated the vulnerability using a Prompt Forcing technique.

5H AGO— AI Desk

P810NORTH KOREAN HACKERS COMPROMISED 30,000 DEVICES

Law enforcement agencies have issued a joint advisory detailing a sustained campaign by the North Korean hacking group WaterPlum, which compromised at least 30,000 devices worldwide and stole over $10.7 million in cryptocurrency between December 2025 and July 2026.

6H AGO— Security Desk

P809HOW TO CHECK YOUR PC FOR MALWARE

If your PC is running slowly or behaving unusually, malware may be the culprit. Running a malware check is a straightforward way to diagnose and address the problem.

6H AGO— Security Desk

◄ BACK TO NEWS

PHPBB PATCHES 10-YEAR AUTH BYPASS FLAW

■ MORE FROM THE SECURITY DESK

■ SUBSCRIBE TO THE DAILY BRIEF