The Sangoma FreePBX Security Team has issued urgent warnings about a critical zero-day vulnerability in the Endpoint Manager module affecting FreePBX versions 16 and 17, which is being actively exploited against systems with Administrator Control Panels (ACP) exposed to the internet. Since at least August 21, 2025, attackers have leveraged the flaw to achieve unauthenticated remote code execution (RCE) and privilege escalation, allowing arbitrary command execution under the web server or Asterisk user, installation of persistent backdoors, deployment of cleanup scripts, and exfiltration of call detail records. Multiple organizations have reported server compromises impacting thousands of SIP extensions and hundreds of trunks, with observed indicators of compromise including modified configuration files, the presence of a “.clean.sh” script, suspicious POST requests to “modular.php”, unauthorized ampuser entries in databases, and unusual extension 9998 call activity. While Sangoma has released an EDGE update for testing and promised a stable fix within days, it stresses that the patch only protects future installations and cannot clean already compromised systems. CTIX analysts strongly advise any affected readers to immediately restrict ACP access to trusted networks or VPNs, verify systems for compromise, rotate all credentials, restore from pre-attack backups, and rebuild on patched versions once the stable release is available. A formal CVE and post-mortem report are expected following the conclusion of Sangoma’s ongoing investigation.