FreePBX servers hacked via zero-day, emergency fix released

According to Sangoma FreePBX Security Team, an actively exploited zero-day vulnerability in exposed FreePBX administrator control panels has impacted systems with the ACP accessible from the internet. The advisory notes that since 21 August, attackers have been exploiting the flaw, prompting an emergency EDGE module fix for testing and a later standard security release.

Administrators are urged to limit access to the FreePBX Administrator interface using the Firewall module and to block ACP access if a PIE update cannot be installed promptly. Several customers have reported breaches, with one noting around 3,000 SIP extensions and 500 trunks affected as part of the incident response.

The EDGE fix is intended to protect future installations, but the team cautions it is not a cure for existing systems, and guidance includes restoring from backups taken before 21 August and rotating credentials once patched.