Critical Imunify360 Vulnerability Leaves 56 Million Linux-Hosted Sites Exposed To RCE Attacks

A severe security flaw in Imunify360’s antivirus tool, AI-bolit, puts millions of websites at risk of remote code execution (RCE) attacks.

This vulnerability affects versions before 32.7.4.0 and impacts up to 56 million Linux-hosted sites, primarily on shared hosting platforms.

Discovered in late October 2025, it allows attackers to run arbitrary commands on servers by exploiting the tool’s malware deobfuscation process.

Hosting providers must update immediately to prevent full server compromises.

Imunify360, developed by CloudLinux, scans websites for threats like obfuscated PHP malware. However, its deobfuscation feature, meant to unpack hidden code, executes attacker-supplied functions without checks.

This leads to RCE, where hackers can run system commands, steal data, or escalate privileges to gain root access.

The issue scores a critical 9.9 on the CVSS scale, highlighting its ease of exploitation over networks with low privileges.

An update on November 14 revealed the flaw extends beyond file scans to database scans.

Attackers no longer need to upload malicious files; they can inject payloads into databases via common vectors such as WordPress comments, contact forms, or user profiles.

During routine scans, AI-bolit pulls and deobfuscates this data, triggering the execution. On shared hosting, where database writes are often easy, this makes exploitation trivial and widespread.

Technical Breakdown and Patch Insights

AI-bolit uses heuristics to detect and unpack obfuscated malware in PHP, JavaScript, and HTML files. It runs as a root-privileged service by default, scanning files and databases.

The core problem lies in two deobfuscation flows: the eval-hex pattern and delta/ord transformations.

In the eval-hex pattern, attackers craft code like this simplified example:

php
$data = "test";
$var1 = "\x73\x79\x73\x74\x65\x6d"; // Hex for "system"
$var2 = "\x74\x6f\x75\x63\x68..."; // Command arguments
$var3 = "\x70\x61\x63\x6b"; // "pack"
eval("$var3"($var2));

The scanner matches this, extracts variables, and calls them via Helpers::executeWrapper, a function that invokes call_user_func_array without validating the function name.

If “system” or “exec” is embedded, it runs shell commands, such as creating files or echoing data, to prove compromise.

The delta/ord flow applies sequential transformations using recovered functions, again via executeWrapper.

Deobfuscation is always enabled in scans background, on-demand, or rapid despite a CLI guard suggesting otherwise.

A proof-of-concept file triggers this when scanned with php ai-bolit.php -y -j poc.php, creating a temp file as evidence.

CloudLinux patched it by adding an allowlist in isSafeFunc, allowing only safe decoders like base64_decode, gzinflate, strrev, substr, chr, and ord.

No dangerous functions like system or eval pass. This syntactic approach avoids executing untrusted code.

No CVE has been assigned, and CloudLinux’s only public note is a brief Zendesk article from November 4, 2025, urging upgrades.

A similar RCE flaw hit Imunify360 in 2021, pointing to recurring transparency issues.

Recommendations For Mitigation

Administrators should upgrade to version 32.7.4.0 or later right away.

If patching delays occur, isolate AI-bolit in a container with no network or filesystem access and low privileges.

Contact CloudLinux support to check for signs of exploitation and receive guidance on detection.

This flaw underscores risks in security tools running with high privileges.

Hosting firms serving WordPress or similar sites face the highest threats, as database vulnerabilities lower the bar for attacks.

Stay vigilant with updates to protect your infrastructure.