Sangoma has issued an urgent advisory for an actively exploited zero-day in FreePBX. Admins with internet-exposed control panels are urged to patch immediately.

A critical zero-day (CVE-2025-57819) in FreePBX with a CVSS 10.0 score is being actively exploited. The flaw allows unauthenticated RCE, and admins must patch immediately.

A new security advisory reveals two high-severity flaws in FreePBX, including a stored XSS and a shared OAuth key that could allow for API token forgery and admin compromise.

A critical FreePBX vulnerability (CVE-2025-57819) is being actively exploited to take over phone systems. Learn about the flaw and how to patch it now.

A critical authentication bypass (CVSS 9.3) in FreePBX allows complete PBX takeover when the 'webserver' auth mode is enabled. Attackers can gain an admin session with a crafted HTTP header. Update immediately.

INJ3CTOR3 hackers target FreePBX with EncystPHP web shell via CVE-2025-64328. Malware uses cron jobs for persistence. Patch immediately.

A mundane telephony vulnerability has metamorphosed into a comprehensive server capitulation. Cybersecurity specialists have unearthed a pernicious web

FreePBX fixes critical 9.1 CVSS flaw (CVE-2026-46376) where hardcoded credentials grant unauthenticated portal access. Update your modules now!

Cyble researchers uncover a widespread FreePBX exploitation campaign by INJ3CTOR3 deploying the novel JOMANGY webshell for toll fraud.

Two critical FreePBX RCE vulnerabilities in Superfecta and UCP modules expose servers to authenticated arbitrary code execution and command injection.

TL;DR Two new FreePBX vulnerabilities each carry a CVSS score of 9.3. One gives unauthenticated remote code execution through the UCP module. The other is a SQL injection that can hand an attacker…