Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents

Aug 9, 2026

0 new incidents, 1 with updates.

Updated

  • LivePatched

    FreeSWITCH: exploited SIP MESSAGE command execution (CVE-2026-116779) plus 20 more advisories

    SignalWire published GitHub advisories for FreeSWITCH, the open-source telephony switch behind FusionPBX and many VoIP platforms. The critical one, CVE-2026-116779 (CVSS 9.8), lets anyone who can get a SIP MESSAGE accepted address it to the api chat proto and have FreeSWITCH run any API command, including system for OS commands and inline Lua where mod_lua is loaded. Inbound chat is on by default, the inbound ACL does not cover MESSAGE, and one registered SIP account (or the stock passwordless default directory user) is enough. The advisory says exploitation has been observed in the wild. It is fixed in 1.11.3 (released Aug 28), which adds an enable-chat-api-proto setting that is off by default. Oct 26 and Oct 28 advisories also cover pre-auth memory bugs in mod_xml_rpc WebSocket handling (CVE-2026-116785, CVSS 9.1), ICE checks accepted without STUN MESSAGE-INTEGRITY (CVE-2026-116790, CVSS 9.1), SIP REFER channel-variable injection leading to command execution (CVE-2026-116786), and overflows in mod_rtmp, MSRP, SDP crypto and the Event Socket, all fixed in 1.11.2. Upgrade to 1.11.3.

    SignalWire FreeSWITCHSince Oct 28, 2026

Sponsored

Buy sponsor slot · $149/mo