Recent reports from the Shadowserver Foundationindicate that over 900 Sangoma FreePBX instancesremain infected with web shells as of late February 2026. These compromises are primarily attributed to the exploitation of CVE-2025-64328, a high-severity command injection flaw.

Attack Details

• Vulnerability: CVE-2025-64328 (CVSS 8.6) allows authenticated users with access to the FreePBX Administration panel to execute arbitrary shell commands.
• Method: Attackers, specifically a group tracked as INJ3CTOR3, have been leveraging this flaw since December 2025 to deploy a PHP-based web shell known as EncystPHP.
• Impact: Attackers gain persistent remote access, enabling command execution with asterisk user privileges and unauthorized outbound calls.
• Affected Versions: The vulnerability primarily affects FreePBX versions 17.0.2.36 and above.

Geographic Impact

The U.S. is the most affected region with approximately 401 infected instances, followed by Brazil (51), Canada (43), and Germany (40).

Recommended Actions

1. Update Immediately: Ensure your system is running FreePBX version 17.0.3 or later, which contains the official fix available via the Sangoma Wiki.
2. Restrict Access: Use the FreePBX Firewall module to limit access to the Administrator Control Panel (ACP) to trusted IP addresses only.
3. Audit for Compromise: Check for the presence of a malicious .clean.sh file in /var/www/html/ or suspicious calls to extension 9998 in your CDR logs as detailed by The Shadowserver Foundation.