The company behind the popular vBulletin forum software may have patched a security hole discovered a few weeks ago, but that hasn’t prevented cybercriminals from going on a server hacking spree, according to researchers.

In a posting on its Security Response blog, experts at Symantec said server hacking attempts aimed at vBulletin users reached a high of 2,500 in a single day in hopes of exploiting a remote code execution vulnerability. Attackers are apparently downloading malicious shell scripts to steal system and network data on machines running 5.1.4 through 5.1.9 of vBulletin 5 Connect.

As SecurityWeek explained, these attempts are well worth cybercriminals’ efforts: The machines in question are often being used for high-traffic websites that can be either manipulated for distributed denial-of-service (DDoS) attacks or offered at a high price to the black market for other purposes. This could include sending out malware or stealing data from unsuspecting users.

The vBulletin security issue first came to light in early November, forcing the company to take its own site down for maintenance and issue an emergency patch. At the time, Ars Technica reported a data breach that exposed thousands of user IDs, which prompted a complete mandatory reset of all customer passwords.

An attacker using the name Coldzer0 claimed to have used the vulnerability to launch zero-day attacks against vBulletin users. As a result, Coldzer0’s posts on social media may have led others to pursue their own server hacking attempts. That said, vBulletin has not yet linked the zero-day attack to the vulnerability for which the patch was issued.

Ironically, vBulletin is a particularly popular forum tool for those in the security community, including the organizers of well-known industry gathering DEF CON. According to Silicon Angle, DEF CON had shut down its forums when the vulnerability first surfaced, and it’s unknown whether it is among those subjected to server hacking attempts.

In general, though, this is a classic situation in which attacks targeting places where many users gather is most likely to happen. Those that use the software and haven’t already applied the patch had better heed Symantec’s warnings as quickly as possible.