Hackers Exploiting FreePBX Vulnerability to Deploy Webshell and Gain Control of Systems

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Attackers Exploit FreePBX Vulnerability to Deploy EncystPHP Webshell Hackers are exploiting a critical vulnerability in FreePBX, specifically CVE-2025-64328, to deploy a persistent webshell named EncystPHP. This attack, attributed to the group INJ3CTOR3, allows complete administrative control over compromised VoIP systems. The campaign began in early December 2025, targeting systems with the FreePBX Endpoint Manager's administrative interface. 2 sources 32