Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

The root cause of this breach is a hard-coded JWT signing key embedded directly in the Issabel Framework source code, a classic configuration management failure that allows any attacker with knowledge of the key to forge authenticated tokens and execute arbitrary OS commands without credentials. Because the key was static and shared across all installations, every deployment was equally vulnerable the moment the key became known. This matters greatly because PBX systems handle sensitive voice communications and are often internet-facing, making them high-value targets for espionage, toll fraud, and lateral movement into internal networks. Active exploitation before many organizations could patch underscores the danger of secrets baked into open-source codebases, where they can be discovered through simple source code review. The incident highlights that secure secret management must be a design requirement, not an afterthought.