#cve-2025-64328

#cve-2025-64328

Over 900 Sangoma FreePBX instances remain infected with web shells from CVE-2025-64328 exploitation, with 401 located in the U.S., actively exploited by threat actors delivering EncystPHP web shells.

Approximately 900 Sangoma FreePBX instances remain infected with web shells following exploitation of CVE-2025-64328, a post-authentication command injection vulnerability patched in November 2025.