Critical Imunify360 Vulnerability Exposes Millions of Linux-Hosted Sites to RCE Attacks

A critical Remote Code Execution vulnerability has been patched in Imunify360 AV, a security product protecting approximately 56 million websites worldwide. Hosting companies must apply the patch immediately to prevent potential server compromises. The issue was documented on 4 November 2025, according to Zendesk, with a CVSS severity score of 8.2 and no CVE identifier assigned at the time.

Security researchers traced the flaw to two deobfuscation engine code flows that could execute dangerous system functions, enabling arbitrary command execution and complete hosting compromise. Imunify360 AV runs with root privileges in many shared hosting environments, creating severe escalation risks if exploited.

Administrators should apply vendor-supplied updates promptly, and if patching is impractical, isolate the scanner in containers with minimal privileges and no network access, per guidance from CloudLinux and related advisories.