SignalWire shipped FreeSWITCH 1.11.3 on August 28, 2026. The vendor called it an important release with critical security fixes. It closes a FreeSWITCH vulnerability that attackers already use for remote code execution in the wild. Why this matters FreeSWITCH powers countless VoIP systems, including many FusionPBX deployments. So a server takeover hands an attacker your phone infrastructure. Researchers confirmed real-world abuse, not just theory.

TL;DR Mitel published two advisories. The first covers a MiCollab command injection bug rated critical at CVSS 9.8, which an unauthenticated attacker can reach over the network. The second covers a reflected XSS issue in OpenScape UC rated high at CVSS 8.0. Neither flaw has a CVE identifier yet. Why It Matters MiCollab sits at the center of enterprise voice and collaboration deployments.

CVE-2026-2329 is a stack-based buffer overflow vulnerability classified under CWE-121, found in the HTTP API endpoint /cgi-bin/api.values.get of Grandstream GXP1610 series VoIP phones, including models GXP1610, GXP1615, GXP1620, GXP1625, GX

A critical vulnerability in Grandstream GXP1600 series VoIP phones allows a remote, unauthenticated attacker to gain root privileges and silently eavesdrop on communications.