What happened (short and spicy)

Security researchers found an unauthenticated SQL injection bug in the Sangoma Switchvox VoIP platform that’s being actively abused. The flaw lives in the /pa HTTP endpoint, which parses XML messages and naively glues a PhoneIP value into a SQL query. That sloppy concatenation lets attackers turn a simple request into a ticket to run commands on the target machine.

In plain human terms: crooks are sending crafted XML, getting the system to run shell commands, and then trying to open a reverse shell to take over the box. Honeypots caught these exploits coming from a single IP (176.65.148.184) in quick succession, so this isn’t just a one-off prank — it’s active and noisy.

Why you should care and what to check

The issue is tracked as CVE-2026-9586 and was one of a dozen flaws reported to Sangoma earlier this year; a patch shipped in Switchvox version 8.4.0.2 (released July 14). There are roughly 4,000 Switchvox systems visible on the internet, mostly in the U.S., and researchers expect most exposed devices will be or already have been probed.

If you run Switchvox, here’s a quick checklist to follow right now:

  • Upgrade to Switchvox version 8.4.0.2 or later immediately if you haven’t already.
  • Search your logs for odd entries — the researchers called out suspicious lines in /var/log/switchvox/db-quirks.log as a sign of tampering.
  • Look for unusual outbound network activity, especially connections to 176.65.148.184 or traffic on port 39323.
  • Review running processes and recent command history for anything unfamiliar; attackers in the wild were enumerating top processes and exfiltrating the results encoded in base64.
  • If you suspect compromise, isolate the device and collect forensic artifacts (logs, process lists, network captures) before rebooting or wiping.

Quick note: the researchers haven’t seen active misuse of the other 11 bugs they reported, but since one critical flaw is already in play, it’s a good time to patch and audit everything.

If you want to stay a little less stressed: patch, scan, and watch your logs like somebody stole your coffee machine — because they might have also stolen your phone server.