Secure Reality announced a vulnerability in phpSecurePages that allows remote users to execute commands on the server without authentication.
Secure Reality plans a full advisory shortly.
Prior versions are assumed to be vulnerable but have not been tested by Secure Reality. A remote user can upload commands to the server and cause them to be executed. The vendor has release version 0.25 beta that corrects the problem. Secure Reality also provided patches. See the source message for information on the Secure Reality patches.