CVE-2025-48827 & 48828: How vBulletin’s API and Template Engine Got Weaponized

Two critical, actively exploited vulnerabilities in vBulletin forum software—CVE-2025-48827 and CVE-2025-48828—have put thousands of websites at immediate risk of full system compromise. In this episode, we dissect how these flaws, triggered by insecure usage of PHP’s Reflection API and abuse of vBulletin’s template engine, allow unauthenticated attackers to execute arbitrary PHP code and gain remote shell access.We’ll break down the exploit chain, from protected method invocation via malformed API calls to injection of malicious <vb:if> conditionals, enabling full Remote Code Execution (RCE) in vulnerable versions of vBulletin running PHP 8.1 or later. You’ll learn how attackers are currently weaponizing these bugs in the wild—leveraging public exploit code and scanning endpoints like /ajax/api/ad/replaceAdTemplate to plant backdoors.We also cover:Patch levels and which versions are safe (hint: upgrade to v6.1.1 now)Temporary mitigations for legacy vBulletin deploymentsIOC monitoring, containment strategies, and threat hunting adviceWhy dynamic method invocation should never be your access control boundaryLessons for developers and sysadmins on avoiding similar reflection-based pitfallsWhether you run a vBulletin forum or just want to understand the anatomy of a modern web RCE exploit, this episode is your front-row seat to one of 2025’s most serious application-layer vulnerabilities.