The Shadowserver Basis has revealed that over 900 Sangoma FreePBX cases nonetheless stay contaminated with internet shells as a part of assaults that exploited a command injection vulnerability beginning in December 2025.
Of those, 401 cases are positioned within the U.S., adopted by 51 in Brazil, 43 in Canada, 40 in Germany, and 36 in France.
The non-profit entity mentioned the compromises are possible achieved by way of the exploitation of CVE-2025-64328 (CVSS rating: 8.6), a high-severity security flaw that would allow post-authentication command injection.
“The impression is that any consumer with entry to the FreePBX Administration panel might leverage this vulnerability to execute arbitrary shell instructions on the underlying host,” FreePBX mentioned in an advisory for the flaw in November 2025. “An attacker might leverage this to acquire distant entry to the system because the asterisk consumer.”
The vulnerability impacts FreePBX variations larger than and together with 17.0.2.36. It was resolved in model 17.0.3. As mitigations, it is suggested so as to add security controls to make sure that solely approved customers have entry to the FreePBX Administrator Management Panel (ACP), prohibit entry from hostile networks to the ACP, and replace the filestore module to the newest model.
The vulnerability has since come below lively exploitation within the wild, prompting the U.S. Cybersecurity and Infrastructure Safety Company (CISA) so as to add it to its Recognized Exploited Vulnerabilities (KEV) catalog earlier this month.
 |
| Supply: The Shadowserver Basis |
In a report revealed late final month, Fortinet FortiGuard Labs revealed that the menace actor behind the cyber fraud operation codenamed INJ3CTOR3 has been exploiting CVE-2025-64328 beginning early December 2025 to ship an internet shell codenamed EncystPHP.
“By leveraging Elastix and FreePBX administrative contexts, the online shell operates with elevated privileges, enabling arbitrary command execution on the compromised host and initiating outbound name exercise by the PBX setting,” the cybersecurity firm famous.
FreePBX customers are advisable to replace their FreePBX deployments to the newest model as quickly as potential to counter lively threats.
