RTC security
Newsletter

January 2026: Cisco UCM zero-day, 39C3 telco talks, FreePBX exploitation

We’re kicking off 2026 with a packed edition. A Cisco UCM zero-day is being actively exploited, 39C3 had some excellent talks on VoLTE and satellite eavesdropping, and the FreePBX vulnerability chain we covered last year now has both a Metasploit module and a weaponized web shell in the wild.

In this edition, we cover:

• Back to breaking things in 2026: what we’re working on and what we found in 2025
• 39C3 talks of interest: South Korean telco breaches, satellite SIP/RTP leaks, and ISDN at Congress
• EncystPHP web shell exploits FreePBX: INJ3CTOR3 is back targeting PBX systems
• Element Call and Magicall: WebRTC-based privacy communication tools
• Phone phreaking, social engineering in the age of voice AI and voice biometrics
• Yealink RPS vulnerability finally gets a CVE
• Security updates round-up: Cisco UCM zero-day, Zoom MMR command injection, ALGO 8180 SIP RCE zero-days, coturn weak RNG, and more

The RTCSec newsletter is a free periodic newsletter bringing you commentary and news around VoIP and WebRTC security. We cover both defensive and offensive security as they relate to Real-time Communications.

December 2025: Year in review, FreePBX vulns, see you in 2026

Welcome to the December 2025 edition of the RTCSec newsletter! This edition is out a bit early so we can take a well-deserved break over the holidays.

In this edition, we cover:

• The best and worst of 2025 in RTC security: from unfixable hardware disasters to solid standards progress
• SIPGO denial-of-service vulnerability we reported (now fixed)
• More FreePBX vulnerabilities: authentication bypass and SQL injection
• Tin Can VoIP device analysis: security questions parents should ask
• Plus security updates for Fanvil, WebRTC, Firefox, and Mitel

The RTCSec newsletter is a free periodic newsletter bringing you commentary and news around VoIP and WebRTC security. We cover both defensive and offensive security as they relate to Real-time Communications.

November 2025: VoIP and WebRTC vulnerability roundup

Welcome to the November edition of the RTCSec newsletter. It’s a quieter month, with less VoIP and WebRTC news than usual.

In this edition:

• Security fixes from Cisco, FreePBX, Firefox, Jitsi, and PJSIP
• Unpatched vulnerabilities in an end-of-life AudioCodes FAX/IVR product
• Microsoft Teams impersonation and spoofing vulnerabilities
• Remote acoustic sensing research (the spooky, secret-service kind)
• And a few more items

The RTCSec newsletter is a free periodic newsletter bringing you commentary and news around VoIP and WebRTC security. We cover both defensive and offensive security as they relate to Real-time Communications.

October 2025: RTP attacks, Cisco VoIP phones, satellite leaks, and nation-state breaches

Welcome to the October 2025 edition of RTCSec Newsletter. This month brings us deep discussions on RTP security, critical vulnerabilities in widely deployed VoIP phones, massive satellite communication leaks, and a telecom infrastructure breach that went undetected for nine months.

In this edition, we cover:

• Our news: 2026 penetration testing bookings, OpenSIPIt meeting on RTP Bleed and Inject, and our VoIP eavesdropping defense guide
• Cisco VoIP phone vulnerabilities: Balazs Bucsay’s detailed presentation on critical flaws including unauthenticated remote packet capture
• Satellite link vulnerabilities: Research exposing massive unencrypted traffic from T-Mobile, AT&T, US military, and more
• Ribbon Communications breach: Nine-month nation-state intrusion into a major telecom infrastructure provider
• Blue Angel Software Suite: Active exploitation of hardcoded credentials and command injection affecting VoIP/SIP appliances
• WebRTC and Matrix RTC: Privacy leaks research on cross-browser IP metadata exposure, plus Matrix security and encryption architecture improvements
• Kamailio bogus CVEs: Why those configuration file vulnerabilities are nonsense
• Security updates round-up: Cisco, FreePBX, Ubiquiti, Issabel, and data breach reports

The RTCSec newsletter is a free periodic newsletter bringing you commentary and news around VoIP and WebRTC security. We cover both defensive and offensive security as they relate to Real-time Communications.

September 2025: more RTP, FreePBX and Voice AI vulnerabilities this time

Welcome to the latest edition of RTCSec Newsletter for September 2025. In this edition, we cover:

• Our presentations at ClueCon and RTC.ON, clarification about DTLS-SRTP and RTP Bleed
• FreePBX security fixes galore and technical details
• Voice-AI and good old toll fraud
• Round up of RTC security vulnerabilities that were addressed this month

The RTCSec newsletter is a free, periodic newsletter bringing you commentary and news about VoIP and WebRTC security. We cover both defensive and offensive security as they relate to Real-time Communications.

August 2025: WHY 2025, Black Hat, DEF CON, ClueCon and FreePBX 0day ITW!

It has been a very busy month in the world of VoIP and WebRTC security, and we have the latest and greatest newsletter edition so far. Here’s the hard proof:

wc -w newsletters/* | sort -nr | head
   73257 total
    3671 newsletters/2025-08-rtcsec-news.md
    3468 newsletters/2023-03-rtcsec-news.md
    3464 newsletters/2025-06-rtcsec-news.md
    ...

In this edition, we cover:

• Newsletter feedback and a tip for procrastinators
• ClueCon 2025: Media Security Is Hard: The Many Ways RTP & SRTP Still Fail Us
• WHY 2025 - Die Hardcoded: Unlocking Yealink’s (weakest) secrets
• FreePBX 0day vulnerability in the EPM module exploited (CVE-2025-57819)
• Asterisk security updates - CVE-2025-49832 / CVE-2025-1131 / CVE-2025-54995 / CVE-2025-57767
• DEF CON 33: Journey to the Center of the PSTN
• TURN Server Abuse: ‘Ghost Calls’ C2 Evasion Technique
• August: The Month of Hacker Conferences: DEF CON 33 and WHY 2025
• BT Home Hub 2006: DSL and SIP Reverse Engineering Analysis
• Security Updates and Vulnerability News Round-Up, including updates to the Matrix protocols and WebEx

The RTCSec newsletter is a free, periodic newsletter bringing you commentary and news about VoIP and WebRTC security. We cover both defensive and offensive security as they relate to Real-time Communications.

July 2025: Rtpengine fixes, RTC conferences and showers of vulnerabilities

It’s July - peak summer season - but it won’t stop raining where we’re located! So we’ve prepared some newsletter content for your entertainment.

In this edition, we cover:

• We have three news items from Enable Security:
  • An advisory for rtpengine
  • ClueCon attendance and presentation next week
  • RTC.ON conference, presentation and discount code
• Reverse Engineering and Cracking a 2006 BT Home Hub for VoIP!
• Discussion of the Jitsi Meet privacy feature / issue
• Short news covering Mitel, Cisco, Grandstream and WebRTC vulnerabilities

The RTCSec newsletter is a free periodic newsletter bringing you commentary and news around VoIP and WebRTC security. We cover both defensive and offensive security as they relate to Real-time Communications.

June 2025: WebRTC security, privacy and Yealink provisioning vulnerabilities

Welcome to the June edition of RTC Sec newsletter, your favorite source of VoIP and WebRTC security commentary.

In this edition, we cover:

• Celebrating the OWASP ASVS v5 release with the WebRTC chapter
• Yealink YMCS security problems have been published
• More WebRTC security items, including STUN DDoS, WebRTC’s security/privacy reputation, and Meta abusing WebRTC to bypass privacy controls
• Numerous vulnerabilities, mostly fixed, in Sangoma, Audiocodes, Qualcomm chipsets, Cisco, Mitel, and others
• Plug for TADSummit Online and a LinkedIn article about overlooked UC security

The RTCSec newsletter is a free, periodic newsletter bringing you commentary and news about VoIP and WebRTC security. We cover both defensive and offensive security as they relate to Real-time Communications.

May 2025: VoIP conferences, VoLTE vulnerabilities and so much more

This month was marked by SIP Server conferences, as I attended both Kamailio World and OpenSIPS Summit. This edition includes a review of the Kamailio World presentations of security-interest, while next month we’ll cover ones from OpenSIPS Summit.

I’d also like to welcome all the people who joined this newsletter from Kamailio World and OpenSIPS Summit!

In this packed edition, we cover:

April 2025: Verizon’s CDR compromise, Cisco VoIP security flaws and phreaking

Welcome to the April edition of the RTCSec Newsletter!

In this edition, we cover:

• Our upcoming presentations on SIP server configuration security and OWASP ASVS including WebRTC
• Verizon’s call detail records compromised by a security researcher
• SIP ALG vulnerabilities and learning about NAT types
• Cisco VoIP security flaws and cool vulnerability demos
• Good old phone phreaking from days gone by
• So much more

The RTCSec newsletter is a free periodic newsletter bringing you commentary and news around VoIP and WebRTC security. We cover both defensive and offensive security as they relate to Real-time Communications.