Hacked Forum: phpBB, vBulletin and MyBB Cleanup

By Glenn Lyvers · Updated September 21, 2026 · 4 min read

Forum software has a particular profile: a large user table, uploads enabled by design, custom modifications applied years ago by somebody who has moved on, and frequently a version that has not been updated since the community was at its peak. That combination makes forums a reliable target, and it makes cleanup fiddlier than a typical brochure site.

Why forums get hit

Three things at once. Registration is open by design, so an attacker does not need to break in to get an account — they can simply sign up and start probing authenticated functionality. Uploads are enabled for avatars and attachments, which is an input path into your filesystem. And the software is frequently old, because forums tend to be run by volunteers and updating means breaking the modifications that make the board work.

The user table is also genuinely valuable. Forum accounts come with email addresses and password hashes, and forum users are exactly the population most likely to have reused that password elsewhere.

Start with the uploads

Avatar and attachment directories should contain images and documents and nothing executable. Search them for PHP files, and search image files for PHP tags, since a polyglot that passes an image check is a well-worn route on forum software — my guide on PHP hidden in image files covers how those work.

Check for an unexpected .htaccess anywhere in the upload tree, which is how an attacker persuades the server to execute what it stored. And confirm PHP execution is disabled in those directories, which is the single most effective hardening measure available on a forum.

The modification problem

This is what makes forum cleanup different. Many boards have had file edits applied directly to core files over the years to add features, which means you cannot simply replace core with a clean copy without losing functionality the community depends on.

Work out what modifications exist before you start. If there is documentation, use it. If there is not, comparing core files against a clean copy of the same version gives you a list of every modified file, and each one then needs reading to decide whether the change is a legitimate modification or an injection. It is slower than a standard cleanup and there is no way around it. Going forward, favour plugin-based extensions over file edits so the next cleanup is not a research project.

Accounts and the user table

Check for administrator and moderator accounts you did not create, and for existing accounts that have been promoted. Then treat the whole user table as exposed: email addresses and password hashes were readable if the database was, and hashes from older forum software may use algorithms that are weak by current standards.

That means a forced password reset for everyone, and a notice telling members plainly that their email address and password hash may have been taken and that they should change that password anywhere they reused it. That is the genuinely important part for your members, and it is the part boards most often skip out of embarrassment.

The rest of the cleanup

Preserve evidence, then work through the file comparison, remove what does not belong, and sweep the database for injected content — check post content, signatures, custom profile fields and template or style data, all of which can carry markup on forum software.

Check templates and themes for injected scripts. Rotate the database password, all administrator passwords and any API or integration credentials. Then update the software to a supported version, which is the actual fix and which is worth the disruption to your modifications.

Keeping it clean

Get onto a supported version and stay there, even if that means reworking modifications as proper extensions. Disable PHP execution in upload directories. Add registration controls that reduce automated signups. Remove extensions and themes nobody uses, and prune moderator accounts for people who left years ago.

For an old board on abandoned software, it is worth asking honestly whether migrating to a currently maintained platform is less work than maintaining this one indefinitely. If you want the board cleaned properly, modifications and all, without losing what makes it work, that is work I take on — see the platforms I clean.

Common questions

Why are forums targeted so often?

Open registration means attackers can get an authenticated account without breaking in, uploads are enabled by design as an input path, and the software is frequently years out of date because updating breaks the modifications the board relies on. The user table is valuable in its own right.

Can I just replace core files with a clean copy?

Usually not directly, because many boards have modifications applied to core files. Compare against a clean copy of the same version to list every modified file, then read each one to decide whether it is a legitimate modification or an injection. It is slower, and there is no shortcut.

Do I have to tell my members?

Yes. If the database was reachable, their email addresses and password hashes were taken, and older forum software often uses hashing that is weak by current standards. Members need to know so they can change that password anywhere they reused it, which is the real risk to them.

What is the most effective hardening for a forum?

Disabling PHP execution in the avatar and attachment directories. Uploads are the standing input path into your filesystem, and removing the ability to execute what lands there defeats the most common route regardless of how the file got past validation.

Should I migrate to different forum software?

Worth considering honestly if your board runs on something abandoned or if maintaining the modifications has become the main cost of ownership. Migration is disruptive, but so is indefinitely maintaining software that no longer receives security fixes.