Vulnerability Spotlight: PHP deserialize vulnerability in Cloud Linux Imunity360 could lead to arbitrary code execution

Summary: Cisco Talos discovered a PHP deserialization vulnerability, TALOS-2021-1383 (CVE-2021-21956), in the Ai-Bolit functionality of CloudLinux's Imunify360 security platform. The flaw can trigger automatically when an attacker creates a malicious file on a system configured for real-time file system scanning, or when a user scans an attacker-supplied file with the Ai-Bolit scanner, allowing controllable data to cause a deserialization condition and arbitrary code execution.
What's compelling: The vulnerable software is itself a security platform for web-hosting servers, and Talos confirmed versions 5.8 and 5.9 could be exploited - so the tool meant to protect hosted sites can become the path to code execution if it is not updated.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-21956
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026