Loading story…
Attackers are actively exploiting CVE-2026-89026, a critical Issabel Framework vulnerability affecting Issabel PBX deployments. A universal hard-coded HS256 JWT signing key in pbxapi/index.php allows unauthenticated remote attackers to forge trusted bearer tokens, call the /pbxapi/manager/originate API endpoint, and abuse Asterisk's System application to execute arbitrary operating-system commands as the Asterisk service account. Shadowserver observed exploitation beginning September 9; VulnCheck assigned the flaw a CVSS v4 score of 9.3 and listed it as known exploited.
Issabel patched the issue by replacing the universal key with one stored in /etc/issabel.conf; organizations should urgently apply the fix associated with commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. Defenders should remove public exposure of PBX APIs and Asterisk management interfaces, restrict access to those services, and investigate affected hosts for anomalous authentication events, originate requests, process or command execution under the Asterisk account, and suspicious outbound network activity.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
The Shadowserver Foundation first observed active exploitation of CVE-2026-89026, which allows forged JWT bearer tokens to trigger operating-system command execution through Issabel's Asterisk integration.
Issabel released a patch that replaces the universal hard-coded HS256 JWT signing key with a key stored in /etc/issabel.conf, addressing unauthenticated command execution in the Issabel Framework.
VulnCheck added CVE-2026-89026 to its Known Exploited Vulnerabilities database and rated the flaw 9.3 under CVSS v4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FreePBX remediated **CVE-2025-57819**, an insufficient input-validation vulnerability affecting FreePBX versions 15, 16, and 17. The flaw can let an attacker gain unauthorized access and potentially execute arbitrary code on affected PBX systems. FreePBX reported active exploitation against multiple version 16 and 17 deployments with internet-exposed management interfaces, particularly where IP filtering and access-control lists (ACLs) were inadequate. Organizations should apply the vendor security updates, confirm the Endpoint module is at the required patched version, restrict administrator interfaces to trusted networks, and investigate exposed systems using FreePBX-provided indicators of compromise.
Aug 31, 2026
Attackers have been exploiting **CVE-2025-64328**, a post-authentication command injection flaw in the *Sangoma FreePBX Endpoint Manager* (filestore component) to compromise internet-exposed FreePBX systems and deploy persistent web shells. The vulnerability affects FreePBX versions `17.0.2.36` and above prior to `17.0.3`, and can be abused by an authenticated user via the `testconnection -> check_ssh_connect()` function to execute commands and gain remote access as the `asterisk` user; the issue is fixed in **17.0.3**. Reporting indicates the activity began in **December 2025** and has left hundreds of systems persistently backdoored with web shells. The **Shadowserver Foundation** reported roughly **900** FreePBX instances still compromised, with the largest concentration in the **United States** (about **400**) and additional impacted systems across **Brazil, Canada, Germany, France, the UK, Italy, and the Netherlands**. Fortinet/FortiGuard Labs identified a PHP web shell dubbed **EncystPHP** associated with the campaign, which supports remote command execution, persistence, and additional web shell deployment; follow-on risk includes VoIP-focused abuse such as **outbound call fraud** and potential network pivoting from the PBX host. One source also states the vulnerability has been added to **CISA’s Known Exploited Vulnerabilities (KEV) Catalog**, reinforcing the need for rapid patching and incident response on exposed FreePBX deployments.
Jun 29, 2026
FreePBX, the open-source IP PBX platform, has patched several critical vulnerabilities in its Endpoint Manager module that could allow attackers to bypass authentication and achieve remote code execution. Researchers from Horizon3.ai identified three high-severity flaws: CVE-2025-66039 (authentication bypass via forged Basic Auth headers when 'webserver' authorization is enabled), CVE-2025-61675 (multiple SQL injection vulnerabilities across several endpoints), and CVE-2025-61678 (arbitrary file upload enabling PHP webshell deployment). These vulnerabilities, when chained, allow unauthenticated attackers to gain full control over affected FreePBX instances, posing a significant risk to business communications infrastructure. The authentication bypass is not present in the default configuration but becomes exploitable if certain advanced settings are enabled. Attackers can exploit these flaws to access protected endpoints, manipulate the underlying SQL database, and upload malicious files for command execution. The vulnerabilities were responsibly disclosed to FreePBX maintainers, and patches have been released. Organizations using FreePBX, especially those with non-default authentication settings, are urged to update immediately to mitigate the risk of compromise.
Jun 29, 2026