CVE-2025-64328 exploitation impacts 900 Sangoma FreePBX instances

**Active exploitation of CVE-2025-64328 in Sangoma FreePBX** led to the deployment of the EncystPHP web shell across roughly 900 systems worldwide; attackers exploited a post-authentication command-injection in the Endpoint Manager to achieve remote command execution, create persistent root access (including SSH key injection and new users), harvest credentials, remove logs and competing shells, and deploy additional payloads — activity attributed to INJ3CTOR3 and tracked by Shadowserver, FortiGuard, and CISA (added to KEV).