sangoma

The Shadowserver Foundation has revealed that over 900 Sangoma FreePBX instances still remain infected with web shells as part of attacks that exploited a command injection vulnerability starting in December 2025. Of these, 401 instances are located in the U.S., followed by 51 in Brazil, 43 in Canada, 40 in Germany, and 36 in France. The non-profit entity said the compromises are likely accomplished via the exploitation of CVE-2025-64328 (CVSS score: 8.6), a high-severity security flaw that could enable post-authentication command injection. "The impact is that any user with access to the FreePBX Administration panel could leverage this vulnerability to execute arbitrary shell commands on the underlying host," FreePBX said in an advisory for the flaw in November 2025. "An attacker could leverage this to obtain remote access to the system as the asterisk user." Security researcher M. Cory Billington, who is credited with discovering and reporting the vulnerability, said it could be abused to trigger command injection after authenticating to the FreePBX Administration GUI by sending an HTTP request with the "command" parameter set as "testconnection" and "driver" set as "SSH." The vulnerability resides in FreePBX's framework module. The problem has to do with the fact that user-provided values – host, port, user, key, and path – specified in the request and used for checking the SSH connection are not sanitized, thereby allowing an attacker to execute arbitrary commands. "$key is leveraged to create a directory name via the dirname() method, which is saved in $keypath," Billington explained. "This value is used without being checked in the exec("mkdir -p $keypath"); function so long as the $keypath value is not an existing directory. We can inject values into this so long as there is a / and some text after." The vulnerability affects FreePBX versions higher than and including 17.0.2.36. It was resolved in version 17.0.3. As mitigations, it's advised to add security controls to ensure that only authorized users have access to the FreePBX Administrator Control Panel (ACP), restrict access from hostile networks to the ACP, and update the filestore module to the latest version. The vulnerability has since come under active exploitation in the wild, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities (KEV) catalog earlier this month. In a report published late last month, Fortinet FortiGuard Labs revealed that the threat actor behind the cyber fraud operation codenamed INJ3CTOR3 has been exploiting CVE-2025-64328 starting early December 2025 to deliver a web shell codenamed EncystPHP. "By leveraging Elastix and FreePBX administrative contexts, the web shell operates with elevated privileges, enabling arbitrary command execution on the compromised host and initiating outbound call activity through the PBX environment," the cybersecurity company noted. FreePBX users are recommended to update their FreePBX deployments to the latest version as soon as possible to counter active threats. (The story was updated after publication on March 4, 2026, to include additional details of the flaw shared by security researcher M. Cory Billington.)

Approximately 900 Sangoma FreePBX instances remain infected with web shells in attacks that exploited a command injection vulnerability starting December 2025. Sangoma FreePBX is a web-based, open source graphical user interface that serves as a widely deployed management tool for Asterisk-based IP telephone systems. The exploited bug, tracked as CVE-2025-64328 (CVSS score of 8.6) and patched in November 2025, impacts the filestore module of the endpoint manager’s administrative interface. Described as a post-authentication command injection issue, the flaw allows an attacker logged in as any user with access to the interface to execute arbitrary shell commands on the underlying host and gain remote access to the system. Last month, Fortinet revealed that a hacking group tracked as INJ3CTOR3 had been exploiting CVE-2025-64328 for over a month to deploy a web shell called EncystPHP. The web shell provides the attackers with remote command execution, persistent access, and web shell deployment capabilities. “These incidents begin with the exploitation of a FreePBX vulnerability, followed by the deployment of a PHP web shell in the target environments. We assess that this campaign represents recent attack activity and behavior patterns associated with INJ3CTOR3,” Fortinet said. A week later, the US cybersecurity agency CISA added the CVE to its Known Exploited Vulnerabilities (KEV) list alongside CVE-2019-19006, another FreePBX bug exploited by the same hacking group. Now, non-profit organization The Shadowserver Foundation says that approximately 900 FreePBX instances remain compromised and are running web shells. The endpoint manager deployments were likely compromised via CVE-2025-64328, it notes. Most of the compromised instances (roughly 400) are in the US, data from The Shadowserver Foundation shows. Dozens of instances are in Brazil, Canada, Germany, France, the UK, Italy, and the Netherlands, and smaller numbers in many other countries. Users are advised to update the filestore module in their FreePBX deployments to the latest version, to restrict access to the administrative panel to authorized users, and to block access from known malicious sources. Related: Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience Related: Critical Flaws Exposed Gardyn Smart Gardens to Remote Hacking Related: SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown Related: Zyxel Patches Critical Vulnerability in Many Device Models

Con il suo ultimo Operational Summary, il CSIRT, su agosto 2025, ha riportato 136 eventi cyber, in calo del 45% rispetto a luglio. I settori più colpiti sono stati telecomunicazioni, manifatturiero e servizi finanziari. Agosto 2025, ancora in calo gli eventi cyber Il CSIRT Italia ha pubblicato l’Operational Summary per il mese di agosto 2025, riscontrando 136 eventi cyber, ossia -45% rispetto a luglio. I 41 incidenti totali sono stati 21 in meno rispetto al mese precedente. I settori maggiormente vulnerabili sono stati: telecomunicazioni. Manifattura. Servizi finanziari. Sempre nel medesimo riferimento temporale, c’è stata la pubblicazione di 3.733 nuove Vulnerabilità ed esposizioni comuni (CVE). Anche in questa voce si è assistito ad una diminuzione, in particolare -204 CVE nel confronto con luglio. Ad agosto le comunicazioni dirette, effettuate dal CSIRT Italia per segnalare potenziali compromissioni o fattori di rischio ad amministrazioni ed imprese italiane, sono state 2.933. La conferma è stata anche qui quella di un calo. Tipologia e andamento degli incidenti Il calo – nel confronto tra agosto e luglio e agosto – ha interessato tutti i settori di analisi, confermando una tendenza comunque positiva nell’ottica del Sistema Paese. Se telecomunicazioni, manifattura, servizi finanziari sono i comparti più vulnerabili, in termini di numero relativo di soggetti colpiti da eventi per settore impattato, da luglio a agosto sono cresciuti: manifatturiero (+10%). Istruzione (+77%). Vulnerabilità e minacce Gli alert sulle vulnerabilità che il CSIRT Italia ha pubblicato sul suo sito sono stati 48. Insieme al consueto aggiornamento mensile di Microsoft (che ha portato alla risoluzione di 111 nuove vulnerabilità, 1 di tipo 0-day), altri prodotti al centro dell’analisi. Ossia: SonicWall. Sangoma. Adobe. Citrix. Fortinet FortiSIEM, FortiWeb, FortiOS, FortiPAM, FortiProxy, FortiSwitchManager. Passando invece agli attacchi ransomware, ad agosto nessuno di questi ha colpito soggetti critici. Al contrario, il 21% ha colpito soggetti a media criticità ed il restante 79% ha coinvolto soggetti a criticità minore. Si è così confermata la tendenza, da parte dei criminali cibernetici, di colpire “obiettivi meno strutturati e dotati di limitate capacità di cybersicurezza“. Per le rivendicazioni ransomware, il monitoraggio di fonti aperte (agosto 2025) ha permesso di individuare 13 rivendicazioni di attacchi ransomware a danno di soggetti italiani. Nei medesimi 31 giorni, al contempo, il CSIRT Italia non ha individuato rivendicazioni di attacchi DDoS in danno di soggetti italiani. Erano state 46 il mese prima. Di qui, ad agosto 2025 sono state diramate un totale di 1.068 comunicazioni “verso i soggetti della constituency che esponevano pubblicamente su Internet complessivamente 2.059 servizi a rischio“.

Samsung’s September 2025 security updates for Android devices include a patch for a vulnerability that has been exploited in the wild. The exploited bug, tracked as CVE-2025-21043 (CVSS score of 8.8), is described as an out-of-bounds write issue in the libimagecodec.quram.so image parsing library, which is used by applications that process images on Samsung devices. According to Samsung, successful exploitation of the security defect allows remote attackers to execute arbitrary code on vulnerable devices. “Samsung was notified that an exploit for this issue has existed in the wild,” the mobile phone maker notes in its advisory. The company has not shared details on the flaw, nor on the observed exploitation, but credited the Meta and WhatsApp security teams for reporting it on August 13. The timing of the report and the fact that the Samsung zero-day was in a core image library suggests that CVE-2025-21043 might have been exploited in attacks targeting WhatsApp users, just as was CVE-2025-43300, an out-of-bounds write issue in the ImageIO framework component of iOS, iPadOS, and macOS. The Apple bug, WhatsApp said two weeks ago, was likely chained with a WhatsApp vulnerability tracked as CVE-2025-55177 in “a sophisticated attack against specific targeted users”. The Meta-owned communication platform said at the time it had notified less than 200 users of potential attacks targeting their devices. WhatsApp also notified industry peers, including Apple and Samsung. WhatsApp’s late August advisory made no mention of CVE-2025-55177 being exploited against Android users, although Amnesty International’s Donncha Ó Cearbhaill said that both iPhone and Android users were impacted. The attacks were attributed to spyware vendors. “Early indications are that the WhatsApp attack is impacting both iPhone and Android users, civil society individuals among them. Government spyware continues to pose a threat to journalists and human rights defenders,” Ó Cearbhaill said. Most likely, a commercial spyware vendor found a way to target the out-of-bounds write holes in OS-level code that WhatsApp interacts with and achieve code execution on both iOS and Android. SecurityWeek has emailed Samsung for clarification on the vulnerability and will update this article if the company responds. *Updated with additional information from WhatsApp. Related: Hackers Exploit Sitecore Zero-Day for Malware Delivery Related: Two Exploited Vulnerabilities Patched in Android Related: Sangoma Patches Critical Zero-Day Exploited to Hack FreePBX Servers

Sangoma has released emergency patches for a zero-day vulnerability exploited to hack FreePBX servers with the administrator control panel accessible from the internet. Tracked as CVE-2025-57819 (CVSS score of 10/10), the bug is described as an insufficient sanitization of user-supplied data. Successful exploitation of the flaw allows attackers to access the FreePBX administrator panel, enabling database manipulation and remote code execution (RCE). Fixes were rolled out for FreePBX versions 15, 16, and 17, after Sangoma discovered that the security defect had been exploited in the wild starting on or before August 21. The hacked servers had inadequate IP filtering/ACLs, as noted in a GitHub advisory. “This initial entry point was then chained with several other steps to ultimately gain potentially root level access on the target systems,” the advisory reads. The issue was discovered in the commercial “endpoint” module. Users are advised to lock down all administrator access, remote internet access to the FreePBX servers, ensure the servers are protected by a firewall, update to a patched version, and check that the “endpoint” has the recommended fixes. “Users should check their automated security updates are active. We are aware of a current issue in the v17 “framework” module that may prevent automated update notification emails,” Sangoma notes. Sangoma has released indicators-of-compromise (IOCs) to help administrators hunt for signs of exploitation, as well as recommended restoration steps. On Friday, the US cybersecurity agency CISA added CVE-2025-57819 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it by September 19, as mandated by Binding Operational Directive (BOD) 22-01. Although BOD 22-01 only applies to federal agencies, all organizations are advised to review CISA’s KEV list and take the necessary steps to mitigate the security defects it identifies. Sangoma FreePBX is an open source interface for the management of Asterisk, a framework for real-time, multi-protocol communications applications. Related: WhatsApp Zero-Day Exploited in Attacks Targeting Apple Users Related: Citrix Patches Exploited NetScaler Zero-Day Related: Organizations Warned of Exploited Git Vulnerability

The Sangoma FreePBX Security Team has issued an advisory warning about an actively exploited FreePBX zero-day vulnerability that impacts systems with an administrator control panel (ACP) exposed to the public internet. FreePBX is an open-source private branch exchange (PBX) platform widely used by businesses, call centers, and service providers to manage voice communications. It's built on top of Asterisk, an open-source communication server. The vulnerability, assigned the CVE identifier CVE-2025-57819, carries a CVSS score of 10.0, indicating maximum severity. "Insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator, leading to arbitrary database manipulation and remote code execution," the project maintainers said in an advisory. The issue impacts the following versions - FreePBX 15 prior to 15.0.66 FreePBX 16 prior to 16.0.89, and FreePBX 17 prior to 17.0.3 Sangoma said an unauthorized user began accessing multiple FreePBX version 16 and 17 systems connected to the internet starting on or before August 21, 2025, specifically those that have inadequate IP filtering or access control lists (ACLs), by taking advantage of a sanitization issue in the processing of user-supplied input to the commercial "endpoint" module. The initial access obtained using this method was then combined with other steps to potentially gain root-level access on the target hosts, it added. In light of active exploitation, users are advised to upgrade to the latest supported versions of FreePBX and restrict public access to the administrator control panel. Users are also advised to scan their environments for the following indicators of compromise (IoCs) - File "/etc/freepbx.conf" recently modified or missing Presence of the file "/var/www/html/.clean.sh" (this file should not exist on normal systems) Suspicious POST requests to "modular.php" in Apache web server logs dating back to at least August 21, 2025 Phone calls placed to extension 9998 in Asterisk call logs and CDRs are unusual (unless previously configured) Suspicious "ampuser" user in the ampusers database table or other unknown users "We are seeing active exploitation of FreePBX in the wild with activity traced back as far as August 21 and backdoors being dropped post-compromise," watchTowr CEO Benjamin Harris said in a statement shared with The Hacker News. "While it's early, FreePBX (and other PBX platforms) have long been a favorite hunting ground for ransomware gangs, initial access brokers and fraud groups abusing premium billing. If you use FreePBX with an endpoint module, assume compromise. Disconnect systems immediately. Delays will only increase the blast radius." CVE-2025-57819 Added to CISA KEV Catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added CVE-2025-57819 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by September 19, 2025. "Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution," the agency said. Technical Details of CVE-2025-57819 Released In an analysis released on September 10, 2025, watchTowr Labs said the vulnerability has been used as a conduit to serve web shells and a bash cleanup script ("/var/www/html/.clean.sh") designed to erase evidence after backdoor access. The cybersecurity company also noted that CVE-2025-57819 stems from the fact that it allows access to certain files ending with ".php" directly without the need for authentication (e.g., "/admin/ajax.php") and combine it with a post-auth SQL Injection in the FreePBX endpoint module. "The custom FreePBX class loader allows you to include any file ending with the .php extension from the admin/modules location," it noted. "The official patch focuses narrowly on fixing the SQL Injection in the endpoint module. But the bigger issue – this 'authentication bypass' quirk that lets you include .php files pre-auth – sits in the core FreePBX code untouched." watchTowr said this behavior on fully patched systems exposes a "juicy" attack surface that allows bad actors to directly hit certain module .php files without logging in. As a next step, the SQL injection could be transformed into a full-blown remote code execution scenario by inserting a malicious row into a table called "cron_jobs" by specifying the command to be executed. In all, an attacker can issue an HTTP request as below to achieve code execution - GET /admin/ajax.php?module=FreePBX\\modules\\endpoint\\ajax&command=model&template=x&model=model&brand=x'+;INSERT+INTO+cron_jobs+(modulename,jobname,command,class,schedule,max_runtime,enabled,execution_order)+VALUES+('sysadmin','watchTowr','id+>+/tmp/watchTowr',NULL,'*+*+*+*+*',30,1,1)+--+ HTTP/1.1 Host: freepbx.lab (The story was updated after publication on September 12, 2025, with details about the vulnerability.)

The Sangoma FreePBX Security Team is warning about an actively exploited FreePBX zero-day vulnerability that impacts systems with the Administrator Control Panel (ACP) is exposed to the internet. FreePBX is an open-source PBX (Private Branch Exchange) platform built on top of Asterisk, widely used by businesses, call centers, and service providers to manage voice communications, extensions, SIP trunks, and call routing. In an advisory posted to the FreePBX forums, the Sangoma FreePBX Security Team warned that since August 21, hackers have been exploiting a zero-day vulnerability in exposed FreePBX administrator control panels. "The Sangoma FreePBX Security Team is aware of a potential exploit affecting some systems with the administrator control panel exposed to the public internet, and we are working on a fix, with expected deployment within the next 36 hours," reads the forum post. "Users are advised to limit access to the FreePBX Administrator by using the Firewall module to limit access to only known trusted hosts." The team has released an EDGE module fix for testing, with a standard security release scheduled for later today. "The EDGE module fix provided should protect future installations from infection, but it is not a cure for existing systems," warned Sangoma's Chris Maj. "Existing 16 and 17 systems may have been impacted, if they a) had the endpoint module installed and b) their FreePBX Administrator login page was directly exposed to a hostile network e.g. the public internet." Admins wishing to test the EDGE release can install it using the following commands: FreePBX users on v16 or v17 can run: $ fwconsole ma downloadinstall endpoint --edge PBXAct v16 users can run: $ fwconsole ma downloadinstall endpoint --tag 16.0.88.19 PBXAct v17 users can run: $ fwconsole ma downloadinstall endpoint --tag 17.0.2.31 However, some users have warned that if you now have an expired support contract, you may not be able install the EDGE update, leaving your device unprotected. If you are unable to install the EDGE module, you should block access to your ACP until the full security update is released tonight. Flaw actively exploited to breach servers Since Sangoma published the advisory, numerous FreePBX customers have come forward stating that their servers had been breached through this exploit. "We are reporting that multiple servers in our infrastructure were compromised, affecting approximately 3,000 SIP extensions and 500 trunks," a customer posted to the forums. "As part of our incident response, we have locked all administrator access and restored our systems to a pre-attack state. However, we must emphasize the critical importance of determining the scope of the compromise." "Yep my personal PBX was affected as well as one I help manage. The exploit basically allows the attacker to run any command that the asterisk user is allowed to," another user posted to Reddit. While Sangoma has not shared any details regarding the exploited vulnerability, the company and its customers have shared indicators of compromise that can be checked to determine if a server has been exploited. These IOCs include: Missing or modified /etc/freepbx.conf configuration file. The presence of /var/www/html/.clean.sh shell script. This is believed to have been uploaded by the attackers. Suspicious Apache log entries for modular.php. Unusual calls to extension 9998 in Asterisk logs as far back as August 21. Unauthorized entries in the ampusers table of MariaDB/MySQL, specifically looking for a suspicious "ampuser" username in the far-left column. If it is determined that a server is compromised, Sangoma recommends restoring from backups created prior to August 21, deploying the patched modules on fresh systems, and rotating all system and SIP-related credentials. Administrators should also review call records and phone bills for signs of abuse, especially unauthorized international traffic. Those with exposed FreePBX ACP interfaces may already be compromised, and the company urges administrators to investigate their installations and secure systems until a fix can be applied. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report