Cyber Centre Daily Advisory Digest — 2026-07-17 (3 advisories)

What Happened

The Canadian government's cyber security agency released three alerts on July 17, 2026. The first warns about serious flaws in FreePBX, a popular phone system software, that could let attackers take control without needing a password. The second covers multiple security holes in VMware's Avi Load Balancer, a product used to distribute network traffic. The third is a routine update for Google Chrome on desktop computers. Anyone using these products should update to the latest versions as soon as possible to protect against potential attacks.

Key Takeaways

• FreePBX 16 and 17 have multiple critical vulnerabilities including unauthenticated RCE via socket.io namespace auth bypass and AMI action injection, and unauthenticated SQL injection leading to administrator takeover.
• Broadcom VMware Avi Load Balancer has multiple vulnerabilities addressed under VMSA-2026-0005, covering CVE-2026-47865 through CVE-2026-47871.
• Google Chrome for Desktop requires update to version 150.0.7871.128/.129 (Windows/Mac) or 150.0.7871.128 (Linux) to address undisclosed vulnerabilities.
• All three advisories were published on 2026-07-17 by the Canadian Centre for Cyber Security as part of their daily digest.

Affected Systems

• FreePBX 17 – Security-Reporting ucp versions prior to 17.0.9
• FreePBX 16 – Security-Reporting missedcall versions prior to 16.0.11
• FreePBX 17 – Security-Reporting missedcall versions prior to 17.0.6
• FreePBX 17 – Security-Reporting tts versions prior to 17.0.6
• FreePBX 16 – Security-Reporting tts versions prior to 16.0.6
• FreePBX 17 – Security-Reporting music versions prior to 17.0.7
• FreePBX 16 – Security-Reporting framework versions prior to 16.0.47
• FreePBX 17 – Security-Reporting framework versions prior to 17.0.30
• VMware Avi Load Balancer – multiple versions
• Google Chrome for Desktop – versions prior to 150.0.7871.128/.129 (Windows/Mac), 150.0.7871.128 (Linux)

Vulnerabilities (CVEs)

Attack Chain

1. Exposure: Vulnerable FreePBX, VMware Avi Load Balancer, or Google Chrome instances are accessible to attackers.
2. Exploitation: Attackers leverage unauthenticated RCE, SQL injection, or other disclosed vulnerabilities to compromise systems.
3. Impact: Compromise ranges from code execution to privilege escalation and potential full system takeover.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No detection rules or queries are provided in this advisory digest. The advisories are patch-focused with references to vendor security bulletins.

Detection Engineering Assessment

Required Log Sources

• FreePBX application logs
• Asterisk AMI logs
• VMware Avi Load Balancer access and error logs
• Web application firewall (WAF) logs
• Browser crash/security event logs

Hunting Hypotheses

Control Gaps

• WAF rules may not cover FreePBX-specific attack vectors such as socket.io namespace auth bypass or AMI action injection.
• Network-based detection may miss encrypted exploitation traffic if TLS inspection is not in place for FreePBX or VMware Avi Load Balancer management interfaces.
• EDR coverage may be absent on PBX appliances and load balancer infrastructure, limiting post-exploitation detection.

Key Behavioral Indicators

• Unauthenticated access to FreePBX UCP socket.io endpoints followed by AMI action requests
• SQL injection signatures in FreePBX missedcall Caller ID name parameters
• Unexpected TTS AGI command execution in FreePBX TTS module
• Anomalous Asterisk Call File creation in FreePBX Music module context
• Unexpected backup restoration activity in FreePBX framework module

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider restricting network access to FreePBX administration interfaces and AMI ports to trusted IP ranges only.
• Evaluate whether VMware Avi Load Balancer management interfaces are exposed to untrusted networks and restrict access where possible.
• If supported by your WAF, consider deploying custom rules to detect and block SQL injection and command injection patterns targeting FreePBX endpoints.

User Protection

• Consider enabling automatic Chrome updates for desktop endpoints if not already configured.
• If your organization uses FreePBX, consider notifying telephony administrators of the critical nature of these updates.

Security Awareness

• Consider incorporating awareness of PBX system vulnerabilities into existing infrastructure security training for IT operations teams.
• If applicable, remind administrators that unauthenticated remote code execution flaws in public-facing systems require immediate attention.

MITRE ATT&CK Mapping