FreePBX security advisory (AV26-680)

Serial number: AV26-680
Date: July 9, 2026

On July 9, 2026, FreePBX published security advisories to address vulnerabilities in the following products:

• FreePBX API (FreePBX 17) – versions prior to 17.0.9
• FreePBX Backup (FreePBX 17) – versions prior to 17.0.11

The Cyber Centre encourages users and administrators to review the web links provided, apply the necessary updates and perform the suggested mitigations.

• Authenticated API generatedocs Host Command Injection
• Authenticated Arbitrary SSH Key Injection via Backup Module
• FreePBX Security Advisories