phpBB forum fixes auth bypass bug lurking for a decade
2026-06-12T19:23:30Z•d943120092a390cee5350355fe677895344c47ccf5999ba832dcf39d927317b0
AUR-compromiseBOD-26-04CISACVE-2026-35273ContiCoupangIvanti-SentryKyushu-ElectricNovo-NordiskTchapauthentication-bypasscrypto-launderingdata-breachinfostealerpeopleSoftphpBBrootkitsupply-chainvulnerabilityzero-day
What happened
A cluster of high-impact security incidents and advisories: a 10‑year‑old authentication bypass in phpBB allows account takeover (including admins); over 400 Arch User Repository packages were compromised to distribute a Linux rootkit and infostealer; Oracle disclosed and mitigated an actively exploited PeopleSoft zero‑day (CVE-2026-35273) used in ShinyHunter data‑theft attacks; CISA issued emergency patching orders (BOD 26‑04) requiring federal agencies to remediate an actively exploited Ivanti Sentry flaw within days; major breaches and disclosures include Novo Nordisk (clinical‑trial data),
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- d943120092a390cee5350355fe677895344c47ccf5999ba832dcf39d927317b0
- Enrichment time
- 2026-06-12T19:23:30Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.