All Articles

TL;DR for CISOs: The ShinyHunters extortion crew has publicly claimed the Ernst & Young breach disclosed earlier this month and given the firm until July 31 to make contact before it leaks client tax records. Separately, a public exploit has landed for an unauthenticated remote code execution flaw in self-hosted vBulletin forums, roughly four weeks after the fix quietly shipped. It was a light Monday for confirmed incidents, so this is a shorter edition with two verified stories and a dated watch list of active-exploitation items still worth your attention.

ShinyHunters claims the EY breach and sets a July 31 leak deadline

What happened

EY disclosed earlier in July that a third-party IT service management platform, used by its own technology staff to support teams doing tax work for clients, had been compromised, and that support tickets holding client tax information were taken. The firm said it spotted the intrusion on April 23 and traced the access window to late March through mid-April, when documents were downloaded. What EY did not do was name the compromised platform, spell out the exact data elements, or put a number on the people affected beyond what state regulators required.

On July 27 the ShinyHunters group filled part of that silence for its own ends, listing EY on its leak site and setting a July 31 contact deadline. The group told reporters it got in through stolen credentials tied to a supply-chain compromise and used them to move into EY's developer and cloud tooling, naming Jira, GitHub, and Azure. Those are the group's assertions, not established fact. EY has neither confirmed that ShinyHunters carried out the attack nor acknowledged an extortion demand, and the stolen data had not surfaced publicly as of the disclosures. What is verified is narrower and still serious: a breach of a support system that routed sensitive tax records, an access window of roughly two weeks, and a regulator filing that puts the confirmed count in the low thousands with room to grow.

Evidence

Two independent, verified sources:

• BleepingComputer: Ernst & Young data breach claimed by ShinyHunters extortion gang
• GBHackers: ShinyHunters Claims EY Data Breach, Threatens to Leak Stolen Client Tax Data

What this means for your team

The uncomfortable part of this story is not the ransom note, it is the entry point. A support ticket queue is where clients hand over exactly the material a tax engagement needs: identity documents, account numbers, and filings. When that queue lives on a vendor's platform, its security is your clients' security, and most third-party risk reviews never ask what actually accumulates inside a support system over time. The second lesson is about the claim itself. Whether or not ShinyHunters truly reached EY's Jira, GitHub, and Azure, the tactic it describes is now routine: steal a credential somewhere in the supply chain, then ride trusted integrations into code, tickets, and cloud. That is identity and integration abuse, not a firewall problem, and it does not show up in traditional sign-in monitoring. Treat the extortion claim as unverified, treat the underlying exposure as real, and assume any Big Four style engagement you rely on could face the same pressure.

Public exploit lands for a pre-auth vBulletin remote code execution flaw

What happened

The flaw sits in the part of vBulletin that evaluates inline math inside templates. A public page route hands a visitor-controlled page-number value into a math tag, which passes it to a function that strips out letters and then runs what remains through PHP's eval. Because digits, parentheses, and arithmetic and binary operators survive the filter, an attacker can reconstruct PHP function names and strings without using a single letter, a restricted-character trick the advisory calls "phpfuck," and turn a template bug into code execution before any login. The proof-of-concept uses that path to rebuild PHP's system function and run an operating-system command, returning the output in the HTTP response.

Framing matters here. The exploit banner calls this a zero-day, but the vendor patched it and shipped 6.2.2 nearly a month before the code became public, so the live risk is concentrated in self-hosted, internet-facing forums that never updated rather than in the software at large. What the public record does not settle is whether anyone used the flaw during the roughly four weeks between the quiet late-June fix and the July 27 disclosure. This is the same corner of vBulletin behind the May 2025 chain (CVE-2025-48827 and CVE-2025-48828), which drew exploitation attempts within days of disclosure after a similarly quiet fix, so the pattern is familiar and the timeline tends to compress once exploit code circulates.

Evidence

• The Hacker News: Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw
• SSD Secure Disclosure: vBulletin Runtime Template runMaths Preauth RCE (vendor advisory and PoC)

What this means for your team

Community forums are easy to forget. They often run on a marketing or community team's budget, sit outside the core patch program, and stay internet-facing by design, which is precisely the profile this exploit rewards. The deeper point is that a missing CVE and a missing severity score are not a reason to wait. National scoring has slowed this year, and a scored feed would have told you nothing about this flaw, yet working exploit code is public and the fix has been available since July 1. If a forum is part of how your customers or members reach you, it deserves the same patch cadence as any other exposed web application, and the version check is quick.

Also notable

Higher-severity, still-active items from the past week that CISOs should keep on the board, with dates so you can judge freshness.

• SharePoint Server CVE-2026-50522 (CVSS 9.8) is under active exploitation after a public proof-of-concept, with attackers stealing IIS machine keys for persistence; watchTowr warns that patching alone is not enough and credentials must be rotated. CISA added it to the KEV catalog on July 22 with a July 25 federal deadline. The Hacker News
• A Fastjson 1.x flaw, CVE-2026-16723 (CVSS 9.0), is being targeted in attacks against Spring Boot fat-JAR applications, and as of July 25 Alibaba had not shipped a fixed 1.x release; enable SafeMode or move to Fastjson2 and inventory transitive dependencies. The Hacker News
• ReliaQuest detailed a campaign, active since June, that poisons DNS on hotel and conference-venue Wi-Fi gateways to redirect travelers to fake Microsoft 365 login pages and hijack accounts without any phishing email; defenses include an always-on full-tunnel VPN and encrypted DNS. BleepingComputer

FAQ

What did ShinyHunters claim about the Ernst & Young breach?

On July 27, ShinyHunters listed EY on its leak site and set a July 31 deadline for the firm to make contact before releasing data. The group told BleepingComputer it used credentials from a supply-chain compromise to reach EY's Jira, GitHub, and Azure environments. EY has not confirmed the actor or these claims, and the data had not been published as of the disclosures.

What data was exposed in the EY breach and how many people are affected?

EY says a third-party IT support platform used for tax work was compromised and that support tickets holding client tax information were taken, potentially including names, addresses, Social Security numbers, financial account details, and payment card data. Filings to the California and Texas attorneys general named at least 1,366 affected residents, described as a minimum rather than a total. EY is offering two years of identity monitoring through Experian.

Is the vBulletin flaw CVE-2026-61511 being exploited in the wild?

As of July 27, no source had confirmed in-the-wild exploitation and the flaw was not in the CISA Known Exploited Vulnerabilities catalog. A working exploit is public, however, and a very similar vBulletin template flaw in 2025 drew exploitation attempts within days of disclosure, so treat patching as time-sensitive.

Which vBulletin versions are affected and how do I fix it?

Self-hosted vBulletin 6.2.1 and earlier, and 6.1.6 and earlier, are affected. Upgrade to version 6.2.2 or apply the branch patch released at the end of June for 6.2.1, 6.2.0, or 6.1.6. Hosted vBulletin Cloud sites were already patched and need no action.

What should CISOs prioritize from this edition?

Question what client data your auditors and managed IT vendors keep in their support and ticketing systems, and tighten integration and OAuth access into your own developer and cloud tooling. In parallel, upgrade any self-hosted vBulletin forums, and from the watch list, prioritize the actively exploited SharePoint and Fastjson flaws.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.