# changelog

author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.18-1
changelog:
  - Make the process for obtaining data for scanning from database more memory efficient (DEF-28660)
  - Fix database scanner to handle large number of databases (DEF-30015)


author: Vitalii Rudnykh <vrudnykh@cloudlinux.com> - 32.1.19-1
changelog:
  - Added support hash-based ignore list (DEF-30171)
  - Fixed fatal error with writing the report to CSV (DEF-30396)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.1.21-1
changelog:
  - api.cas.imunify360.com endpoint is now used for all CAS requests. (DEF-30798)
  - Enhanced detection logic to identify obfuscated PHP code stored in a database. (e.g., SMW-INJ-27029-php.spam.redi-0). (DEF-30771)
  - Increased size limits in real-time. (DEF-29770)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.2.1-1
changelog:
  - Removed hardcoded signatures; uses --avdb for external database. (DEF-8270)
  - Updated copyright year to 2025. (DEF-31174)
  - Added support for Magento 1 and 2 databases for vulnerable tables and fields. (DEF-31333)
  - Added extended-suspicious scanning for specific file extensions and detection of zipped PHP files < 10MB (DEF-31412)
  - Added scanning for wp_hfcm_scripts and wp_snippet tables in WordPress. (DEF-31527)
  - Fixed division by zero error in database restore for single-line cleanup files. (DEF-31523)
  - Fixed bug with infinite loop in deobfuscator (DEF-31754)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.2.2-1
changelog:
  - Optimized WHITE_EXTENDED verdict handling to avoid unnecessary scans. (DEF-31891)
  - Improved MDS scanner to detect non-standard Magento configs. (DEF-32011)
  - Fixed skipping of CMS configs files under 2K. (DEF-32011)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.3.1-1
changelog:
  - Improved malware cleanup reporting with precise hashes and timestamps. (DEF-19851)
  - Extended procu2 report with mtime and hash fields before/after cleanup. (DEF-19852)
  - Handled suspicious detections separately for upload consumers (modsec, ossec). (DEF-29483)
  - Added support for new patch verdicts from Cloud-Assisted Scan API. (DEF-31902)
  - Fixed %preun scriptlet failure in Elevate initramfs during CL8 to CL9 upgrade. (DEF-32217)
  - Implemented patching logic in procu2 using CAS API. (DEF-32652)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.4.1-1
changelog:
  - Convert UTF-16 encoded files to UTF-8 before cleaning to avoid issues (DEF-29075)
  - Fix iconf func support detection (DEF-31028)
  - Disable collecting statistic for case where it is not needed (DEF-33854)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.5.2-1
changelog:
  - Fixed group of admin tools detections. Added admin tools signatures sanitizing to all reports (DEF-34676)
  - Added handling of ambiguity silently by fall-back categor (DEF-34687)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.6.1-1
changelog:
  - New MDS Reporting added (DEF-33704)
  - Removed chattr -i for ai-bolit Files (DEF-34156)
  - Hyperscan crash AiBolitError due to JSONDecodeError fixed (DEF-34584)
  - Added reading of /var/imunify360/.sentry_tags to report errors (DEF-34710)
  - Added the use the same config settings for different scan types (DEF-34875)
  - Improved regex signature optimizer to support Octal escape sequences (DEF-34910)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.7.1-1
changelog:
  - Added scan_id tag to the Sentry event (DEF-35144)
  - Fixed the "--restore" action to correctly revert not all historical cleanups (DEF-35256)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.7.2-1
changelog:
  - Procu2 cleanup: fix normalization regression that modified legitimate files. (DEF-35239)
  - Return correct error code on failure (shared-memory). (DEF-35347)
  - Resident mode: allow admin tools upload when detection is disabled (adminer.php). (DEF-35394)
  - Fix --restore-sig-id restoration by creating proper workdir for detached scans. (DEF-35550)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.7.3-1
changelog:
  - Resident mode: replace SIGTERM with SIGUSR2 for suspicious files. (DEF-35921)
  - Optimize DB restore to use the most recent backup. (DEF-36136)


author: Alexander Tishin <atishin@cloudlinux.com> - 3.9.0-1
changelog:
  - DEF-18719 Add zstd compressed tar support
  - DEF-19309 Include non-client domains to backup list on Plesk when user filter is applied


author: Jason Taylor <jtfas90@gmail.com> - 0.13.0.5-1
changelog:
  - Upstream bugfix release
  - Correction to spec license add MIT license
  - Added asciidoc BuildRequires and docdir files


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.7.1-1
changelog:
  - DEF-26869 Do not search for audit events when no malware found
  - DEF-26867 Keep up to 6 paths for audit events
  - DEF-26868: report failed to parse lines to Sentry. Limit error count in /var/log/messages


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.7.2-1
changelog:
  - DEF-27695 Fix crond events detection during filtering
  - DEF-27707 Track noisy files only when gathering top paths statistics


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.8.1-1
changelog:
  - DEF-27924: Correctly track statistics on sent messages and db rows
  - DEF-26875: Do not drop wp-cache events
  - DEF-28023: auditd-log-reader unit is now managed by i360-agent


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> - 2.8.3-1
changelog:
  - DEF-30200: add ability to set auditdctl custom fields to ignore mariadb/mysql generated events
  - DEF-30201: add public_html/wp-content/debug.log to auditd_exclude


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> - 2.9.0-1
changelog:
  - DEF-29441: add monitoring rules, add filters to send /etc/valiases/, /etc/vfilters, /etc/vdomainaliases paths to corrAPI
  - DEF-28525: add imunify-auditd-log-reader support for Debian and Ubuntu OSes
  - DEF-28084: store and send all events associated with /usr/local/cpanel/uapi


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 2.9.4-1
changelog:
  - DEF-32609: bump go version to 1.24
  - DEF-33474: read complete log lines before parsing (and drop CL6 support)
  - DEF-34634: validate incoming events against basedirs instead of key
  - DEF-34711: use general Imunify approach to set sentry tags


author: Arsenii Pastushenko <apasutshenko@cloudlinux.com> - 2.9.5-1
changelog:
  - DEF-35454: Throttle events processing to avoid extremely high performance overhead
  - DEF-36047: Do not log validate errors
  - DEF-36046: correctly manage auditd configuration file
  - DEF-36062: fix out of range panic in formEvent
  - DEF-36036: correctly handle stale PID file on startup


author: Amit Levy <alevy@cloudlinux.com> - 1.3.7-2
changelog:
  - DEF-35549: Remove GetIgnoredPaths RPC
  - DEF-35523: use grpc stream for ignore list
  - DEF-35345 Add cli interface for grpc-client
  - DEF-35345 Add generic grpc client
  - DEF-35257 Add gRPC client for proactive ignore lists
  - DEF-35109 Read proactive whitelist data from redis datastorage on update


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 1.3.8-1
changelog:
  - DEF-35203: Make naming consistent and get rid of wrong repeated field
  - DEF-35281: Pick users from running Kubernetes pods and use application_id as username
  - DEF-35203: Edit proactive proto


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 1.3.2-2
changelog:
  - DEF-32946: Use dedicated functions for io operations; use delimiters for detecting garbage data
  - DEF-32946: rework fgw tests
  - DEF-32924 Fix incorrect file management by FGW cli


author: Danil Khabibullin <dkhabibullin@cloudlinux.com> - 1.3.4-8
changelog:
  - DEF-34419 Make rotatable JWT secret for proxy API
  - Fix uninstall process
  - DEF-31596 Add proxy server for rpc commands


author: Mikhail Faraponov <mfaraponov@cloudlinux.com> - 2.1.6-1
changelog:
  - DEF-23058: Reduce number of sqlite accesses to database on empty payload
  - DEF-23050: Added graceful extractor sqlite3 connection shutdown


author: Alexander Tishin <atishin@cloudlinux.com> - 7.2.2-1
changelog:
  - DEF-22397 Use a separate inotify watcher for /var/spool/cron real-time scanning
  - DEF-22871 Fix panic on centos 6 when optimize_realtime_scan set to true
  - DEF-23079 Fix 'open /dev/.lxd-mounts: permission denied'


author: Svyatoslav Gormash <sgormash@cloudlinux.com> - 3.7.0-12
changelog:
  - WPT-1623 Remove lsof call from Active Response scripts for better performance 
  - DEF-35839 Remove leftover cronjob on uninstall


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.6-1
changelog:
  - DEF-25203: add LimitNOFILE value to imunify360-pam.service to raise limit of open file descriptors
  - DEF-25862: fix osv-scanner vulnerabilities by updating go version and versions of go modules
  - DEF-26053: build imunify360-pam for Debian 12
  - DEF-26170: remove /usr/lib64/dovecot/|/lib64/dovecot path on DirectAdmin, version 6.4.6-1 only


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.7-1
changelog:
  - DEF-27057: add pure-ftpd hook to enable imunify360-pam pure-ftpd after /scripts/setupftpserver execution disables it on cPanel
  - DEF-26992: replace python wrapper with FailureWatchdog go code on systemd
  - DEF-27119: add systemd activation sockets, add ConnTracker to track idleness
  - DEF-25512: fix imunify360-pam status command


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.8-1
changelog:
  - DEF-29380: replace None value in get_cp_name return value with 'generic'
  - DEF-28575: use wafd's iplist service for whitelisted ips
  - DEF-28697: use local version identifier instead of hyphen in setup.py
  - DEF-29884: add support for dovecot-2.3.21
  - DEF-29917: validate license against alternative public key when present


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.9-1
changelog:
  - DEF-29976: add support for Ubuntu 24
  - DEF-28659: remove centos6/cl6 support
  - DEF-24286: do not log to syslog syscall.EPIPE errors on closed connections


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.10-1
changelog:
  - DEF-32268: wrap logging init in try except block
  - DEF-30929: use /usr/lib/security location instead of /lib/security only on ubuntu24 and debian12


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.12-1
changelog:
  - DEF-35434: add dovecot-native support for dovecot-2.4
  - DEF-37172: add dovecot-pam support for dovecot-2.4


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.13-1
changelog:
  - DEF-36381: build imunify360-pam for Debian 13
  - DEF-37452: add dovecot-native support for dovecot-2.4.2
  - DEF-37502: fix domainowner regex in dovecot-pam mode for dovecot versions higher than 2.4


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.3.0-1
changelog:
  - DEF-30822: enable segfault reporing by default
  - DEF-30987: move 'extension=i360.ini' line from php.ini to php.d/i360.ini
  - DEF-30982: fix i360.ini paths on debian/ubuntu
  - DEF-31181: Add php8.4 support. Enhance php8.3 support on Ubuntu24. Release PD for ea-php8.X for rhel >= 7.


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.4.0-1
changelog:
  - DEF-29731: use imunify-common module for api operations
  - DEF-31896: add script uri, script filename and servername to segfault messages, refactor failure messaging
  - DEF-32116: report i360 events only, increase backtrace depth
  - DEF-31544: add memory limit checks, log to php-daemon when php memory is exhausted
  - DEF-32250: do not create extra files in dangerlist directory
  - DEF-32181: fix monitoring stats memory leak


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.4.1-1
changelog:
  - DEF-32609: update go version to 1.24.1
  - DEF-32882: monitor i360.so segfaults only in ossec trigger
  - DEF-32882: use '*' as a dummy if function name is unavailable in backtrace
  - DEF-32882: check e->name before using it in hash_queue_calc to avoid segfault
  - DEF-32959: cover missing PHP versions for certain platforms
  - DEF-33406: do not execute external commands without timeout
  - DEF-33406: use systemd watchdog to track php-daemon health


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.4.3-1
changelog:
  - DEF-32880: use ef1 hashes when jit_compatible_mode is on
  - DEF-34035: clear outdated events on php-daemon startup


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.4.4-1
changelog:
  - DEF-34424: add i360.so to php.ini for alt-phps to enable i360 on cagefs
  - DEF-34708: use all imunify360-agent's sentry tags


author: Siarhei Pol <spol@cloudlinux.com> 8.4.5-1
changelog:
  - DEF-35040: reduce rules compilation in i360-storage-new.py on cloudways
  - DEF-34985: replace int with size_t in arguments of i360_add_func_param_value_add_new
  - DEF-34749: rate limit monStats aggregator errors
  - DEF-34748: rate limit perfStats aggregator errors


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.5.0-1
changelog:
  - DEF-35813: Release rules.yaml as part of Proactive Defence package
  - DEF-36251: Do not tamper with OPcache optimization level
  - DEF-35677: Optimize installation/removal of i360 in install-clean.sh
  - DEF-35314: Fix APPLICATION_ID functionality for per-application configuration and whitelist loading


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.5.1-2
changelog:
  - DEF-29731: rely on gw directory instead of custom flag at install time
  - DEF-29731: reenable file gateway Correlation API communication when present
  - DEF-35942: enable i360.so in php.d/i360.ini if 'cagefs_disabled=on' is set in cagefs.ini
  - DEF-36588: Removed some manual rules to replace with php_immunity
  - DEF-35459: Switch EF1 hash processing to Block mode


author: Amit Levy <alevy@cloudlinux.com> - 3.5.1-1
changelog:
  - DEF-32816: fix cpu stats not collected if controllers is off
  - DEF-32479: fix ual not synced with systemd


author: Amit Levy <alevy@cloudlinux.com> - 3.5.4-1
changelog:
  - DEF-33715: fix file not found for v1
  - DEF-33922: fix cleaup nested dirs
  - DEF-33922: fix no space when creating metric files
  - DEF-33881: ignore "unknown" parsing errors


author: Miroslav Kovac <mkovac@cloudlinux.com> 1.33.0-1
changelog:
  - DEF-33776 Custom logs rotation
  - DEF-33912: update coraza dependency
  - DEF-33572: implement wildcard domain whitelist matching
  - DEF-33695: Update coraza according to upstream
  - DEF-32893: implement appSpecific rules config loading
  - DEF-32895: implement handling of app specific rulsets during request processing
  - DEF-33666: Remove 'none' UAL verdict from wafd


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.34.0-1
changelog:
  - DEF-33694 Whitelisted domains feature fixed for Coraza mode
  - DEF-32911: Version bump
  - DEF-33097 Disabling webshield in Coraza mode implementation


author: Igor Savenko <bliss@cloudlinux.com> 1.34.0-3
changelog:
  - DEF-34313: webshield-watchdog incorrectly reloads wafd every time it runs in CW environment
  - DEF-34341: Wafd reloading after UAL state in config added
  - DEF-34331: Systemd dependency for ossec-hids service has been added


author: Ruslan Shmelev <rshmelev@cloudlinux.com> 1.35.0-2
changelog:
  - DEF-34816: Whitelist all by using * in domains_whitelist conf file
  - DEF-34743: Fix unbounded memory growth in wafd with coraza
  - DEF-33874: Implementation of coraza persistance storage


author: Igor Savenko <bliss@cloudlinux.com> 1.35.1-1
changelog:
  - DEF-35148: ipset_worker is not returning into pool
  - DEF-35178: Wafd is constantly reloading (CloudWays)


author: Igor Savenko <bliss@cloudlinux.com> 1.35.2-1
changelog:
  - DEF-35295: Missing distinction between expiration of collection variable and of collection itself
  - DEF-35398: webshield 421 Misdirected Request issue with SNI enabled in apache


author: Miroslav Kovac <mkovac@cloudlinux.com> 1.36.0-1
changelog:
  - DEF-35453: support version specific rules
  - DEF-34255 make a CorazaRulesChecker initialized flag reloadable
  - DEF-34255 do not fail wafd if coraza failed to load config/rules
  - DEF-33864 SCRIPT_FILENAME & SCRIPT_USERNAME variables implementation


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.36.1-2
changelog:
  - DEF-35591: read state file before ensuring consistent state
  - DEF-35104: investigation - redirect support, coraza module reference update.


author: Igor Savenko <bliss@cloudlinux.com> 1.36.2-1
changelog:
  - DEF-35740: Imunify360-webshield crashes with core dumps
  - DEF-35866: Added syncing with mutexes to ensureConsistentState
  - DEF-35589: Make sure webshieldctl in configure stage respects current WEBSHIELD_ENABLE state


author: Igor Savenko <bliss@cloudlinux.com> 1.37.0-2
changelog:
  - DEF-36343: Webshieldctl has unnecessary '$' symbol in setting defaults
  - DEF-35128: Implement Coraza Logging
  - DEF-35728: Implement disabling rules per domain for coraza
  - DEF-35740: Imunify360-webshield crashes with core dumps
  - DEF-35867: remove skip on test_modsec_rule_disabled_for_domain for coraza
  - DEF-35870: wafd passing wrong format of http version
  - DEF-35898: [sentry] data not convertible to netlink
  - DEF-35961: [sentry] failed to convert request
  - DEF-36145: wildcard whitelisting is not working correctly
  - DEF-36270: In apache 'module' mode webshield port is not mapped back in splashscreen body
  - DEF-35866: Added syncing with mutexes to ensureConsistentState
  - DEF-35589: Make sure webshieldctl in configure stage respects current WEBSHIELD_ENABLE state


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.37.1-1
changelog:
  - DEF-36663 webshieldctl: is-active action fixed
  - DEF-36363: Custom rules has been placed before coraza ruleset in modsecurity.conf


author: Miroslav Kovac <mkovac@cloudlinux.com> 1.37.3-1
changelog:
  - DEF-36837: process status code if received
  - DEF-36298: ids: add headless browser support to the performance framework


author: Miroslav Kovac <mkovac@cloudlinux.com> 1.38.1-1
changelog:
  - DEF-37554: Change the way we handling transaction closure
  - DEF-35400: Attempt to fix build for debian-based systems


author: Jan Kratochvil <jan@jankratochvil.net> - 4.23.9.0-4
changelog:
  - Fix memory corruption with too many arguments
    https://bugzilla.redhat.com/show_bug.cgi?id=2345921
  - Use %autosetup


