900 Sangoma FreePBX Instances Infected With Web Shells

Back Feeds.Feedburner

900 Sangoma FreePBX Instances Infected With Web Shells

Feeds.Feedburner •Ionut Arghire • February 27, 2026

Share: View original

The attacks exploited a post-authentication command injection vulnerability in the endpoint manager’s interface.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

900 Sangoma FreePBX Instances Compromised by CVE-2025-64328 Exploitation Attackers exploited CVE-2025-64328, a command injection vulnerability, affecting 900 Sangoma FreePBX systems. The exploitation resulted in the installation of web shells, with hundreds of instances remaining compromised since attacks began in December 2025. 5 sources 36

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (2)

T1059 - Command and Scripting Interpreter T1505.003 - Web Shell