Critical Imunify360 AV Vulnerability Exposes 56 Million+ Linux-hosted Websites to RCE Attacks
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A severe remote code execution (RCE) vulnerability has been discovered in Imunify360 AV, a widely used malware scanner<\/a> protecting approximately 56 million websites.<\/p>\n The security flaw, recently patched by CloudLinux, allows attackers to execute arbitrary commands and potentially take complete control of hosting servers.<\/p>\n Patchstack researchers discovered a flaw in Imunify360 AV\u2019s deobfuscation logic used to analyze malicious PHP code.<\/p>\n Attackers can create specially encoded PHP files that mislead the scanner into executing harmful functions, such as system(), exec(), or eval(), during analysis.<\/p>\n Because the scanner typically runs with root privileges, successful exploitation can result in a complete server takeover.<\/p>\n The Patchstack analysis highlights a concerning flaw: deobfuscation is automatically enabled in the default configuration of Imunify360 AV for all scan types.<\/p>\n\nImunify360 AV RCE<\/strong> Vulnerability<\/strong>
\n<\/h2>\n