The Open-Source VoIP / PBX Ecosystem in 2026: A Review¶

Overview¶

The open-source telephony landscape has consolidated significantly since the early 2000s wave of Asterisk-based distributions. Two engines — Asterisk and FreeSWITCH — remain the foundation of nearly every open-source PBX in active use. Most of the "products" people encounter are GUI/management layers built on top of one of these two engines, not independent telephony stacks. Several once-popular distributions have been discontinued, one major platform (FreePBX) has weathered a rough security year, and a handful of newer or lesser-known projects have picked up users looking for alternatives.

This guide summarizes the current state of the ecosystem: what's still active, what's dead, what's changed ownership or license, and what the emerging options look like.

The Two Core Engines¶

Asterisk¶

Asterisk remains the most widely deployed open-source telephony engine in the world. It is a toolkit rather than a turnkey product — it has no native graphical interface, and configuration is done through dialplan files. It powers the majority of the PBX distributions covered below. Asterisk is developed and stewarded by Sangoma, which acquired original creator Digium.

FreeSWITCH¶

FreeSWITCH is the other major open engine and Asterisk's primary competitor. It's actively maintained by SignalWire, a company founded by FreeSWITCH's original creators. It remains free and open source under the Mozilla Public License (MPL), with an optional commercially supported enterprise edition and hosted cloud platform. Development activity on the project (GitHub commits, releases) has continued steadily.

GUI / Distribution Layer: Status Summary¶

FreePBX Security Track Record (2025–2026)¶

Because FreePBX is the default reference point for most people evaluating this space, its recent security history is worth summarizing on its own:

• CVE-2025-57819 (CVSS 10.0): An authentication bypass in the FreePBX Administrator Control Panel allowed unauthenticated remote code execution on internet-exposed systems. Active exploitation began around August 21, 2025. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog, with a mandated patch deadline for U.S. federal agencies. Sangoma released emergency patches for FreePBX 15, 16, and 17.
• CVE-2025-64328 (CVSS 8.6): A post-authentication command injection vulnerability exploited starting in December 2025 to deploy a web shell ("EncystPHP") via FreePBX/Elastix administrative contexts. As of a March 2026 report, over 900 FreePBX instances remained infected, concentrated in the U.S., Brazil, Canada, Germany, and France.

The consistent thread across both incidents: systems with the administrator control panel exposed directly to the public internet were the ones compromised. Current guidance from the FreePBX security team and third-party researchers is to keep administrative interfaces behind a firewall/VPN, maintain aggressive patch cadence, and verify automated update mechanisms are functioning (a known issue affected update notification emails in the v17 framework module).

Discontinued / Legacy Projects¶

• Trixbox (formerly Asterisk@Home) — Discontinued in 2012. The original nonprofit/community edition (trixbox CE) was abandoned by its developer; Fonality, which had acquired the project, shifted focus to a commercial product (trixbox Pro) and ended CE support. The domain trixbox.org no longer hosts an active project.
• Elastix — Predecessor project to Issabel; effectively superseded by its fork.
• Asterisk@Home — The original name for what became Trixbox; folded into the same discontinuation.

Adjacent / Emerging Areas¶

• Rust-based telephony tooling: A small but growing number of Rust-native SIP/PBX and voice-agent projects have appeared on GitHub, reflecting a broader trend of infrastructure tooling migrating toward Rust for performance and memory-safety reasons. These remain early-stage relative to Asterisk/FreeSWITCH and are not yet production-parity replacements, but represent a space to watch.
• Session Border Controllers (SBCs): Projects like Kamailio and LibreSBC serve as a distinct layer from the PBX itself — routing, security, and topology-hiding for larger deployments — and are increasingly discussed alongside PBX software in carrier and multi-tenant contexts.
• Call center-specific stacks: Beyond general PBX software, there's a parallel open-source call-center ecosystem (VICIdial, GOautodial) built on top of Asterisk, oriented toward outbound/predictive dialing and contact-center features rather than general office telephony.

Summary¶

• Asterisk and FreeSWITCH remain the two foundational open-source engines, and neither has been meaningfully displaced.
• FreePBX is still the dominant GUI/distribution by install base, but has had a genuinely difficult security year and requires disciplined patching and network isolation of its admin interface.
• Trixbox is dead and has been since 2012, with no successor bearing its name.
• FusionPBX, Issabel, VitalPBX, and Wazo represent the main active alternatives, each trading off ease-of-use, licensing philosophy, and target audience (SMB office vs. developer/service-provider) differently.
• 3CX has exited the open-source category entirely, which is a relevant distinction for anyone evaluating it based on its earlier reputation.
• The broader ecosystem is stable but not stagnant — security pressure on the most popular platform (FreePBX) is pushing some administrators toward FreeSWITCH-based alternatives, and early-stage Rust tooling suggests where new entrants may eventually come from.