A critical authentication bypass (CVSS 9.3) in FreePBX allows complete PBX takeover when the 'webserver' auth mode is enabled. Attackers can gain an admin session with a crafted HTTP header. Update immediately.

When the facade of a PayPal, Microsoft, or banking “support” number graces a smartphone screen, few perceive the

INJ3CTOR3 hackers target FreePBX with EncystPHP web shell via CVE-2025-64328. Malware uses cron jobs for persistence. Patch immediately.

Effective January 30, 2026, new Google Voice numbers remain inert until you pass a government ID check. Learn how to verify your identity and avoid permanent bans.

Rapid7 publicly discloses a critical zero-day and PoC (CVE-2026-2329) for Grandstream GXP1600 VoIP phones allowing remote root access. Patch now.

Author: Yakov Nissen, Chief Technology Officer, CallnFax

A mundane telephony vulnerability has metamorphosed into a comprehensive server capitulation. Cybersecurity specialists have unearthed a pernicious web

Cisco Talos reveals the rise of TOAD attacks. 55% of scam campaigns now use VoIP "anchors" to bypass email filters and trick victims into calling fraud centers.

Romanian national Gavril Sandu faces up to 30 years in a US prison after extradition over a VOIP vishing and fake debit card fraud scheme.

FreePBX fixes critical 9.1 CVSS flaw (CVE-2026-46376) where hardcoded credentials grant unauthenticated portal access. Update your modules now!

Cyble researchers uncover a widespread FreePBX exploitation campaign by INJ3CTOR3 deploying the novel JOMANGY webshell for toll fraud.

A critical Poly VoIP phone vulnerability is exposed. Read the report now that public exploit code released online to secure your office networks.

Two critical FreePBX RCE vulnerabilities in Superfecta and UCP modules expose servers to authenticated arbitrary code execution and command injection.

TL;DR Two new FreePBX vulnerabilities each carry a CVSS score of 9.3. One gives unauthenticated remote code execution through the UCP module. The other is a SQL injection that can hand an attacker…

Hoax emergency calls are evolving from personal vendettas into systemic public threats. According to a recent official FBI public service announcement, malicious actors now execute coordinated swa…

SignalWire shipped FreeSWITCH 1.11.3 on August 28, 2026. The vendor called it an important release with critical security fixes. It closes a FreeSWITCH vulnerability that attackers already use for…

For the enterprise telephone exchange Sangoma Switchvox, accepting a single specially crafted XML request suffices for a stranger on the internet to reach the server’s command shell. This cr…

Pick up your phone right now and look at the last five calls you missed. There is a very good chance that at least one of those numbers…

TL;DR On October 21, 2026, Cisco published two advisories covering nine Cisco Unified CM vulnerabilities and related voice products. A security hardening release groups internally found bugs into …

TL;DR SignalWire disclosed three critical FreeSWITCH vulnerabilities on October 28, 2026, impacting SIP chat handling, WebSocket frame parsing, and ICE media verification. The most severe flaw, CV…