BreachForums, a notorious cybercrime marketplace and successor to RaidForums, has confirmed that its platform was the target of a sophisticated law enforcement operation exploiting a previously unknown vulnerability, commonly referred to as a “0-day”, in the MyBB forum software. This vulnerability, which had not been previously disclosed or patched at the time of the attack, allowed attackers to potentially bypass standard security controls and gain unauthorized access to the underlying system. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The announcement, signed by the BreachForums administration, follows weeks of speculation and rumors about the site’s sudden outage and potential compromise by global law enforcement agencies. BreachForums has been a recurring target, with previous takedowns and arrests, including the 2023 arrest of its founder, “Pompompurin” (Conor Brian Fitzpatrick)-leading to repeated shutdowns and revivals of the platform. For example, an attacker could send a malicious private message exploiting XSS to an administrator, which, when opened, would trigger a file write vulnerability and plant a PHP shell on the server. In past incidents, attackers have chained together vulnerabilities such as persistent cross-site scripting (XSS) and file write flaws to achieve full server compromise. Using a 0-day vulnerability demonstrates the increasing technical sophistication of law enforcement operations targeting high-profile cybercriminal infrastructure. The administration also warned users against engaging with BreachForums clones, labeling them as potential honeypots operated by law enforcement or scammers. Such exploits can allow attackers to execute arbitrary code on the server, potentially granting full control over the forum infrastructure. To prevent future incidents, BreachForums is actively working on a complete rewrite of its backend, moving away from the compromised MyBB codebase.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 28 Apr 2025 15:10:00 +0000