INJ3CTOR3 malware steals FreePBX SIP credentials for phone fraud
An updated installer uploads 17 configuration files every minute to two staging servers, Cyble reported on October 28.
Stories per day · 30 days
2 RSS
17 stories, newest first · one card per story
Stories tagged #voip
Signal RingRTC before 2.72.0 can keep media flowing after hang-up
CVE-2026-113380, scored CVSS 4.0 9.3, lets a call peer delay teardown so audio and possibly video continue; no in-the-wild use is known.
Signal bug allows listening after hang-up
RingRTC versions before 2.72.0 could let participants hear audio after call end; no exploitation reported.
FreePBX security advisory (AV26-973)
Canadian Cyber Centre advisory AV26-973 lists vulnerable FreePBX modules with fixed versions available in the 16.x and 17.x release lines.
Reviving TEMPEST Attacks With An Injected Signal
InjectEave research recovers device signals by RF injection, including real-time VoIP voice injection at up to 30 meters.
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
Attackers actively exploit CVE-2026-89026, a hard-coded JWT key flaw enabling unauthenticated OS command execution on Issabel PBX systems.
5
Researchers Build WeChat Zero-Click Worm Hijacking Phones via Calls
Calif researchers built WeWorm, a zero-click worm exploiting a WeChat VoIP memory-corruption RCE that Tencent has now patched.
WeChat worm could pwn a friend before they even answered the call
Calif researchers demoed WeWorm, a zero-click WeChat VoIP memory-corruption worm enabling account takeover; Tencent patched it August 21.
WeChat Worm Can Hijack Accounts Without Victims Answering Calls
Researchers demoed WeWorm, a zero-click WeChat worm hijacking accounts via incoming VoIP calls using a memory corruption flaw; Tencent patched it in August.
2
“Zero-click” WeChat worm could hijack accounts and spread via a single call
Researchers discovered a critical memory corruption flaw in WeChat's VoIP stack enabling a zero-click worm, WeWorm, that hijacks accounts via calls; Tencent patched it.
WeWorm – First 0-Click Worm Spreading Through WeChat Calls Across iOS and Android
Researchers demonstrated WeWorm, a zero-click worm exploiting a memory-corruption flaw in WeChat's VoIP stack to spread via calls across iOS and Android.
Teams calls are about to get a lot harder to fake
Microsoft will roll out Brand Impersonation Protection in Teams Calling from mid-May 2026, warning users about suspicious inbound VoIP calls impersonating trusted brands.
[webapps] FreePBX 17.0.2 - Remote Code Execution (RCE)
Exploit-DB published a remote code execution exploit targeting FreePBX version 17.0.2.
Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials
Attackers exploit unauthenticated SQL injection CVE-2026-9586 in Sangoma Switchvox to run PostgreSQL commands and deploy reverse shells.
1
Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)
Attackers actively exploit SQL injection flaw CVE-2026-9586 in unauthenticated Sangoma Switchvox endpoints, dropping reverse shells and second-stage cryptominer malware.
2
Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586
Horizon3 disclosed CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox leading to RCE, now under active exploitation in the wild.
2
Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability
Cisco patched an XXE flaw in BroadWorks' OCI XML parser letting unauthenticated remote attackers read sensitive files from the filesystem.