Asterisk News: 2025 Roadmap & Security Watch

The Asterisk community just wrapped its roadmap sync, and there is plenty for operators to act on.

Roadmap checkpoints

• ARI 2.0 is landing Q2 with better websocket scaling plus native JWT auth – ideal for custom portals.
• Codec Opus updates bring FEC improvements that shave 120ms off recovery in lossy LTE paths.
• Media anchoring is being reworked to simplify multi-region deployments where RTP hairpins are a problem.

Security bulletins to patch

1. AST-2024-009 – SIP re-invite handling could allow caller ID spoofing. Patch level 20.6.2 closes it.
2. AST-2024-011 – Crash on malformed STIR/SHAKEN headers. Enable new parser and rate-limit verification jobs.
3. Transport hardening – Enforce TLS 1.2+, regenerate certificates signed with SHA-1, and audit AMI credentials.

Operational checklist

• Enable the new sorcery/redis cache for presence events; it trims 30% load off Mongo backends.
• Wire your CI pipeline to run sngrep replays against staging before approving new dialplan code.
• Keep an eye on the open-source Asterisk Realtime Dashboard project—perfect for managed services teams who need shared situational awareness.

Need help prioritizing the upgrades? Our voice engineers can run a 2-week readiness sprint that combines config review, load testing, and SOC-aligned monitoring.