Millions of sites at risk from Imunify360 critical flaw exploit

A vulnerability in ImunifyAV/Imunify360 lets attackers upload malicious files to shared servers and execute arbitrary code, risking millions of websites, according to Patchstack. The flaw affects Imunify360 AV before v32.7.4.0 and enables remote code execution via attacker-supplied malware, potentially exposing hosting environments. CloudLinux fixed the vulnerability on 21 October 2025, according to the advisory, but there has been no statement from Imunify360 and no CVE has yet been assigned.

Remote attackers can craft obfuscated PHP that triggers the deobfuscation logic, causing the scanner to execute attacker-controlled functions and system commands, with impact ranging from website compromise to full server takeover depending on hosting configuration. The vulnerability potentially affects Imunify360, ImunifyAV+, and ImunifyAV, and researchers warn that detection is difficult due to layered obfuscation.

Patchstack released technical details and a PoC exploit, and recommends hosting providers check for potential compromises, noting the issue has been publicly available since November 4, 2025.