EIP-2026-109704
PRE-CVEMyBB < 1.8.3 (with PHP 5.6 < 5.6.11) - Remote Code Execution
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-109704. PoCs published by Taoguang Chen.
AI-analyzed exploit summary This exploit demonstrates a GMP deserialization type confusion vulnerability in PHP 5.6 < 5.6.30, leading to RCE in MyBB <= 1.8.3 via crafted cookie deserialization. The PoC manipulates object properties during unserialization to inject PHP code executed via eval().
Description
MyBB < 1.8.3 (with PHP 5.6 < 5.6.11) - Remote Code Execution
Exploits (1)
exploitdb
WORKING POC
by Taoguang Chen · webappsphp
https://www.exploit-db.com/exploits/41150
This exploit demonstrates a GMP deserialization type confusion vulnerability in PHP 5.6 < 5.6.30, leading to RCE in MyBB <= 1.8.3 via crafted cookie deserialization. The PoC manipulates object properties during unserialization to inject PHP code executed via eval().
Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target:
MyBB <= 1.8.3 with PHP 5.6 < 5.6.30
No auth needed
Prerequisites:
PHP 5.6 < 5.6.30 · MyBB <= 1.8.3 · Ability to set cookies
devstral-2 · analyzed Feb 16, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026