Loading story…
Rapid7 released new Metasploit Framework content adding multiple modules that weaponize a FreePBX vulnerability chain starting with CVE-2025-66039 (authentication bypass) to enable unauthenticated attackers to reach remote code execution (RCE). The modules, authored by Noah King and msutovsky-r7, demonstrate how an initial auth bypass can be combined with follow-on flaws to move from external access to full system compromise.
The new FreePBX modules include an exploit that chains CVE-2025-66039 with CVE-2025-61675 (SQL injection) to insert a malicious job into the cron_job database table and execute arbitrary code, plus an auxiliary module using the same SQLi path to create a rogue administrator account. A second exploit chains CVE-2025-66039 with CVE-2025-61678 (unrestricted firmware file upload) to place a webshell on the server for RCE. Separate reporting also notes the same Metasploit update introduced additional exploit modules affecting other enterprise software (including Cacti and SmarterMail), but the detailed technical coverage in the sources focuses primarily on the FreePBX chaining approach and module implementations (e.g., unix/http/freepbx_custom_extension_rce and unix/http/freepbx_firmware_file_upload).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The update also shipped maintenance fixes, including corrections to John the Ripper hash formatting, SSH login scanner session-handling problems when CreateSession was enabled, and Metasploit Pro HTTP bruteforce false positives.
Metasploit expanded post-exploitation capabilities with a persistence module that installs a malicious Burp Suite extension and a unified SSH key persistence module supporting both Windows and Linux.
The same Metasploit update introduced an exploit module for Cacti CVE-2025-24367 and an unauthenticated file upload module for SmarterTools SmarterMail CVE-2025-52691, enabling webshell placement or cron-job creation through path traversal.
Metasploit Framework added three modules targeting FreePBX that chain the authentication bypass CVE-2025-66039 with either SQL injection CVE-2025-61675 or unrestricted file upload CVE-2025-61678 to achieve remote code execution or create an administrator account.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FreePBX, the open-source IP PBX platform, has patched several critical vulnerabilities in its Endpoint Manager module that could allow attackers to bypass authentication and achieve remote code execution. Researchers from Horizon3.ai identified three high-severity flaws: CVE-2025-66039 (authentication bypass via forged Basic Auth headers when 'webserver' authorization is enabled), CVE-2025-61675 (multiple SQL injection vulnerabilities across several endpoints), and CVE-2025-61678 (arbitrary file upload enabling PHP webshell deployment). These vulnerabilities, when chained, allow unauthenticated attackers to gain full control over affected FreePBX instances, posing a significant risk to business communications infrastructure. The authentication bypass is not present in the default configuration but becomes exploitable if certain advanced settings are enabled. Attackers can exploit these flaws to access protected endpoints, manipulate the underlying SQL database, and upload malicious files for command execution. The vulnerabilities were responsibly disclosed to FreePBX maintainers, and patches have been released. Organizations using FreePBX, especially those with non-default authentication settings, are urged to update immediately to mitigate the risk of compromise.
Jun 29, 2026
Rapid7 released a Metasploit update adding **seven new modules** plus multiple enhancements and fixes, including new exploit support for high-severity vulnerabilities affecting AI infrastructure, remote access appliances, and VoIP devices. The release highlights an Ollama model registry path traversal chain (**CVE-2024-37032**, CVSS 8.8) that abuses the `pull` mechanism to achieve arbitrary file write and escalate to **unauthenticated root RCE**, and a Grandstream GXP1600 stack overflow (**CVE-2026-2329**, CVSS 9.3) that can yield a root session and is paired with post-exploitation capabilities such as credential harvesting and SIP traffic interception/proxying. The update also adds/updates an exploit for **BeyondTrust Privileged Remote Access (PRA) / Remote Support (RS)** appliances via **unauthenticated command injection** (**CVE-2026-1731**, CVSS 9.9), and introduces a BeyondTrust helper library to support future module development and port existing modules. On the evasion side, Metasploit gained a Linux ARM64 RC4 “packer” module (`linux/aarch64/rc4_packer`) featuring in-memory ELF execution and sleep-based evasion, while several existing modules and auxiliary scanners received quality-of-life improvements and bug fixes (e.g., improved checks and reduced false positives/crashes).
Jun 29, 2026
Attackers have been exploiting **CVE-2025-64328**, a post-authentication command injection flaw in the *Sangoma FreePBX Endpoint Manager* (filestore component) to compromise internet-exposed FreePBX systems and deploy persistent web shells. The vulnerability affects FreePBX versions `17.0.2.36` and above prior to `17.0.3`, and can be abused by an authenticated user via the `testconnection -> check_ssh_connect()` function to execute commands and gain remote access as the `asterisk` user; the issue is fixed in **17.0.3**. Reporting indicates the activity began in **December 2025** and has left hundreds of systems persistently backdoored with web shells. The **Shadowserver Foundation** reported roughly **900** FreePBX instances still compromised, with the largest concentration in the **United States** (about **400**) and additional impacted systems across **Brazil, Canada, Germany, France, the UK, Italy, and the Netherlands**. Fortinet/FortiGuard Labs identified a PHP web shell dubbed **EncystPHP** associated with the campaign, which supports remote command execution, persistence, and additional web shell deployment; follow-on risk includes VoIP-focused abuse such as **outbound call fraud** and potential network pivoting from the PBX host. One source also states the vulnerability has been added to **CISA’s Known Exploited Vulnerabilities (KEV) Catalog**, reinforcing the need for rapid patching and incident response on exposed FreePBX deployments.
Jun 29, 2026