1st September 2025

Get it for free but then pay attention

I have been surprised at how little interaction there has been about two relatively major FreePBX and PBXact issues in the last few weeks.

First, Debian is inviting FreePBX/PBXact users to upgrade from version 12 (bookworm) to version 13 (trixie) simply by pressing Enter at the Y/n prompt after running "apt update" over SSH. Crazy if you ask me. The commonly used "apt update && apt upgrade -y" would instantly accept the invite and break FreePBX/PBXact 17, which isn't compatible with anything other than Debian 12. Personally, I blame Debian for making it so easy to carelessly proceed. Who really checks what they are updating? Well, now you do. If you are worried about this happening, we have documented the official preventative fix here:

https://support.20tele.com/index.php?rp=/knowledgebase/19/Prevent-APT-invite-to-upgrade-from-Debian-12-bookworm-to-Debian-13-trixie.html

Second, a "zero-day" exploit in the Endpoint Manager module that wasn't disclosed publicly for five days. If your FreePBX/PBXact GUI isn't protected by a firewall from untrusted IP addresses and exposed to the public internet, your system could already be compromised. If the firewall is down, even for just a few moments, then you are vulnerable to attack. Let's hope there isn't any overnight maintenance scheduled by your data centre, because you wouldn't want the firewall auto-disabling for five minutes following a reboot, creating a convenient window of opportunity for the hackers. The solution is to update Endpoint Manager to the current stable module or uninstall it altogether. And please use the onboard firewall; there isn't a good enough reason not to.

If you are reading this and got caught out by either (or both) then you have my utmost sympathy. I understand that keeping up with FreePBX/PBXact maintenance can sometimes feel overwhelming, especially with busy schedules or limited resources. I assume you got everything sorted though because you didn't call or email. In fact, 20tele hasn't received a single request for help with either issue. Zero. I have to be honest, I am shocked.

Do I believe a reported four million deployed systems have been updated and therefore OK since 21st August 2025? No, I don't. I think 25% at best, if Sangoma are lucky. Perhaps they can advise how many recent downloads of "sysadmin --edge" and "endpoint --stable" there have been to date?

20tele is the self-styled "go-to" for all things FreePBX, especially in the UK, and our presence is being felt around the world. Justifiably so, I think. Niche as it is, we are the noisiest partner on every major social media platform and we fly the Sangoma flag higher than anyone else. So, why such stark silence from users back the other way?

Because most users aren't paying attention.

20tele has worked with Sangoma, FreePBX and PBXact for over eight years. The last few weeks have left me concerned and considering what more we can do about it. But it's not a 20tele problem. It's not really a Sangoma problem either. It's a more general problem relating to open-source based software: if you aren't prepared to pay attention then you need to start asking for help. If you are unsure how to manage these urgent obligations and critical requirements then reach out to the community or 20tele. We are here to ensure your systems are up-to-date and secure.

If you download something for free then you are not invested in it, literally. You might spot a few users who truly are because they have posted on the FreePBX Forums and collectively contributed almost 100 posts to each related topic. So where are the rest? They aren't all forum lurkers trying to make sense of the conversations, surely? I know the answer to that rhetorical question, because my posted link summarising what to do had a total of four clicks in 24 hours, so that's one for every million systems.

Some users don't want the PBX license fees and convinced their boss or fellow directors that FreePBX/PBXact and this free-to-use software was the best way forward, but aren't then able to put in the time and effort necessary. Perhaps others have left the organisation and no one can find the keys.

I know choosing FreePBX/PBXact can prove cost-effective, but so does 100% uptime with any proprietary alternative, and these systems require ongoing maintenance to avoid serious issues. I am worried that far too many systems haven't yet been secured with the required fixes. If you don't know what to do then let’s work together to ensure your systems are safe.

I repeat: four million systems and zero requests for help.