# changelog

author: Dmitrii Lozhkin <dlozhkin@cloudlinux.com> - 4.4.0-1
changelog:
- Implement Resident Mode Scan (DEF-9194)
- Add Detached Scan (DEF-9169)
- Smart scan should be disabled by default (DEF-9448)
- Add timestamp to scan results (DEF-9464)
- Optimize file reading approach (DEF-9486)
- Fixed: Ai-bolit is not showing signature name ("sn") (DEF-9634)
- Deobfuscator improved.
- Fixed minor bugs.


author: Dmitrii Lozhkin <dlozhkin@cloudlinux.com> - 4.1.5-1
changelog:
- Fixed: the cloudscan-size parameter doesn't work properly (DEF-9928)
- Fixed: PHPMailer is incorrectly detected as vulnerable (DEF-9859)


author: Dmitrii Lozhkin <dlozhkin@cloudlinux.com> - 4.4.0-2
changelog:
- Implement Resident Mode Scan (DEF-9194)
- Add Detached Scan (DEF-9169)
- The watchdog continuously kills ai-bolit (DEF-9943)


author: Dmitrii Lozhkin <dlozhkin@cloudlinux.com> - 4.4.1-1
changelog:
- Fixed: Bitrix file is removed instead of cleaning (DEF-10052)
- Fixed: Unexpected detection behavior (DEF-9950)


author: Dmitrii Lozhkin <dlozhkin@cloudlinux.com> - 4.4.2-1
changelog:
- Detect ELF (binary) Executables as malicious ones (DEF-8992)
- Smart scan should be disabled by default (DEF-9448)
- Add timestamp to scan results (DEF-9464)
- Optimize file reading approach (DEF-9486)
- Fixed: Too much memory used in new version of aibolit-hoster (DEF-9582)
- Need to add suspicious tracking in console progress (DEF-9659)
- Detect ELF (binary) Executables as suspicious ones (DEF-9818)
- Fixed: The --cloudscan-size doesn't work for single file scannig (DEF-9928)
- Fixed: procu2.php goes to infinite loop while trying to clean samples with mixture of obfuscation and $_POST (DEF-10216)
- Improved deobfuscation algorithms.
- Fixed many other minor bugs.


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 4.4.3-1
changelog:
- Improve deobfuscator (DEF-10368)
- Limit max size to scan for all modes (DEF-10436)
- Find EICAR in smart mode (DEF-10248)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 4.4.4-1
changelog:
- Improve deobfuscator (DEF-10558)
- Fixed segmentation fault on PHP 5.6 (DEF-10519)
- Added support for new HashAPI format for CloudAssist (DEF-10469)
- Fixed not working --addprefix --noprefix options (DEF-10460)
- Added log options for ai-bolit resident mode (DEF-10418)
- Turn off vulnerabilities detection if CMSDetector instance not initialized (DEF-10414)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0116-1
changelog:
- Fixed garbage in system logs (DEF-10943)
- Added samples to deobfuscator (DEF-10818, DEF-10757, DEF-10728, DEF-10608, DEF-10603)
- Removed rules for detect elFinder vulnerability (DEF-10450)
- Added convertor regular expression before search in deobfuscating code (DEF-10729)
- Fixed aibolit normalization (DEF-10896, DEF-10609, DEF-10686)
- Added test for check cleanup malware SMW-SA-13323-php.phish-6 (DEF-10740)
- Changed normalization in procu2 as used in aibolit (DEF-10717)
- Created Jenkins job to test integration with IM360 (DEF-10573)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0207-1
changelog:
- Added new filter option in the scan (DEF-10676) 
- Fixed a bug in RapidScan (DEF-11212) 
- Reduced of disk reads (DEF-10611) 
- Fixed bugs and improved the normalization file (DEF-11124, DEF-10886) 
- Fixed bug in detached mode (DEF-11083) 
- Improved deobfuscator (DEF-11142, DEF-10938, DEF-10895, DEF-10940) 
- Fixed procu2 bug (DEF-10387) 
- Changed the data transfer protocol for CloudAssisted (DEF-10771) 
- Added script to gather statistics after the fall of ai-bolit (DEF-10438) 
- Improved cleanup process (DEF-10849)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 20.0225-1
changelog:
- Use php_strip_whitespace via stream wrapper to get normalization of custom string (DEF-11198)
- Added check normalized->deobfuscated version of file for standalone signatures in procu2 (DEF-11244)
- Fix bug in finder implementation follow dir symlink - by default (DEF-11377)
- Improved deobfuscator (DEF-11367, DEF-11395)
- Add alias for param --quite as --quiet (DEF-11243)
- Fix SIGBUS error (DEF-11343)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0312-1
changelog:
- Improved deobfuscator (DEF-11495, DEF-11442)
- Integrated finder implementation in aibolit (DEF-11406, DEF-11414)
- Added executable bit to Go wrapper (DEF-11530)
- Fixed detached mode scan for empty folder (DEF-11502)
- Fixed files counter for resident mode (DEF-11508)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0323-1
changelog:
- Improved deobfuscator (DEF-11523, DEF-11534, DEF-11541, DEF-11570)
- Fixed UTF-16, UTF-32 support for procu2 (DEF-11553)
- Fixed UTF32-BOM encoding detect (DEF-11552)
- Fixed scan list preparation (DEF-11563, DEF-11606)
- Fixed go-wrapper (DEF-11542, DEF-11543)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0403-1
changelog:
- Improved deobfuscator (DEF-11737, DEF-11706, DEF-11677, DEF-11642)
- Improved debug info (DEF-11545, DEF-11609)
- Added new filter for little files (DEF-10576)
- Fixed using shared memory in go-wrapper (DEF-11739)
- Fixed deobfuscator (DEF-11645)
- Fixed skip option in finder (DEF-11730)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0408-1
changelog:
- Improved deobfuscator (DEF-11804)
- Added sqlite and pdo dependencies
- Fixed cleanup (DEF-11823)
- Fixed deobfuscator (DEF-11805)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0414-1
changelog:
- Fixed cleanup (DEF-11901)
- Fixed using shared memory in go-wrapper (DEF-11739)
- Added common exclude list for scan (DEF-11832)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0429-1
changelog:
- Improved deobfuscator (DEF-11884, DEF-12087, DEF-12154, DEF-12171, DEF-12171)
- Refactoring templates and localization (DEF-10381, DEF-10382)
- Fixed go-wrapper (DEF-12038)
- Fixed DataCollection script (DEF-12039)
- Added parameter --skip-system-owner and --skip-system-owner for finder (DEF-11811, DEF-11813)
- Added CSV report for ai-bolit (DEF-9615)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0507-1
changelog:
- Excluded system owner filter from upload job (DEF-12336)
- Improved deobfuscator (DEF-12306)
- Refactoring (DEF-12194)
- Fixed bug with filenames (DEF-12289)
- Added CSV report for procu2 (DEF-9615)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0521-1
changelog:
- Added --size to procu2 and set 15Mb to default (DEF-12464)
- Changed code for optimization and refactoring (DEF-10378, DEF-12196, DEF-12195)
- Improved deobfuscator (DEF-12459, DEF-12375)
- Fixed small bugs (DEF-12408, DEF-12042)
- Removed Windows dependence (DEF-10389)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0601-1
changelog:
- Improved normalization code (DEF-12426)
- Optimized code for working in resident mode (DEF-12006)
- Improved deobfuscator (DEF-12582, DEF-12519)
- Fixed error in deobfuscator (DEF-12550)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0615-1
changelog:
- Improved deobfuscator (DEF-12718, DEF-12716, DEF-12663, DEF-12636)
- Added optimizations for procu2 (DEF-12749, DEF-12749)
- Changed priority for CloudAssisted (DEF-12772)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.0709-1
changelog:
- Fixed finder module (DEF-13108)
- Improved deobfuscator (DEF-13028, DEF-12991, DEF-12832, DEF-12998, DEF-12856, DEF-12831)
- Refactoring (DEF-10383)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 20.0805-1
changelog:
- Improved deobfuscator (DEF-13205, DEF-13235, DEF-13308, DEF-13333)
- Homoglyphs normalization added (DEF-13161)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.1.1-1
changelog:
- Improved deobfuscator (DEF-13777, DEF-13731, DEF-13712, DEF-13648, DEF-13626, DEF-13636, DEF-13515, DEF-13412, DEF-13383, DEF-13425, DEF-13395, DEF-13367, DEF-13437)
- Added posix dependence for aibolit and procu2 (DEF-13023)
- Added DB timeouts and limits for imunify_dbscan.php (DEF-13726, DEF-13751)
- Added reports for correlation server (DEF-13335)
- Added error reports for problem with CAS (DEF-13365)
- Separated malware databases for imunify_dbscan.php and ai-bolit (DEF-13652)
- Added ability to softly cancel imunify_dbscan.php (DEF-13285)
- Added finder for CMS configs to imunify_dbscan.php (DEF-12224)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 30.8.1-1
changelog:
- Improved deobfuscator (DEF-16318, DEF-16345)
- Added hyperscan feature (DEF-15480, DEF-15481, DEF-15483, DEF-15475, DEF-16141, DEF-16142)
- Extended ai-bolit help (DEF-16219)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.8.2-1
changelog:
- Improved deobfuscator (DEF-16486, DEF-16467, DEF-16439, DEF-16352, DEF-16480)
- Fixed Normalization (DEF-16438)
- Changed the process of setting files for the report (DEF-16372)
- Added sort for procu2 signatures DB (DEF-16522)
- Change php handler in resident mode (DEF-16419)
- Changed progress.json format (DEF-16276)
- Fixed warnings and notices (DEF-16374)
- Changed work with a fallen aibolit in GoWrapper (DEF-16279, DEF-16278, DEF-16277)
- Changed PHP Handler for GoWrapper (DEF-16418)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 30.8.3-2
changelog:
- Improved deobfuscator (DEF-16537)
- Added full/truncated signatures DB (DEF-16405)
- Do not add hyperscan.so on el6 (DEF-16365)
- File-streaming for cloud-assist (DEF-15775)
- Split full and truncated signatures DB (DEF-16404)
- Fixed bug when --hs key provided, but DB not exists (DEF-16607)
- Report all hsdb_maker error's to sentry through wrapper (DEF-16630)
- Forwarded signals to child process for GoWrapper (DEF-16463)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.8.5-1
changelog:
- Fixed a bug with the LevelDB database (DEF-16783)
- Improved GoWrapper (DEF-16747, DEF-16546, DEF-16277)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 30.9.1-1
changelog:
- Improved deobfuscator (DEF-16598, DEF-16640, DEF-16757, DEF-16599, DEF-16750, DEF-16771, DEF-16734, DEF-16848, DEF-16903, DEF-16886, DEF-16794)
- Fixed filters for big ELF binaries(DEF-16691)
- Fixed a bug with the LevelDB database (DEF-16784)
- Added new perfomance related fields to json report (DEF-16772)
- Updated required file locations in MDS (DEF-16868)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.10.2-1
changelog:
- Improved deobfuscator (DEF-17046, DEF-16928, DEF-16902, DEF-16951)
- Fixed double urlencode cleanup (DEF-17045)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.2.1-1
changelog:
- Improved deobfuscator (DEF-13910, DEF-13977, DEF-13967, DEF-13944, DEF-13929, DEF-13889, DEF-13826, DEF-13801)
- Improved normalization (DEF-13824, DEF-13825, DEF-13958)
- Changed logic of switch notify and upload jobs (DEF-13732)
- Changed snippet format (DEF-13897)
- Added detached mode for MDS (DEF-13765, DEF-13774, DEF-13776, DEF-13780)
- Added filter for listing files in standart mode (DEF-13208)
- Added AVD support to MDS (DEF-13764)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.3.1-2
changelog:
- Improved deobfuscator (DEF-14350, DEF-14227, DEF-14321, DEF-14258, DEF-14294, DEF-14268, DEF-14244, DEF-14409, DEF-14371, DEF-14378, DEF-13946, DEF-14084, DEF-14006, DEF-13869, DEF-13998, DEF-13901, DEF-14157)
- Improved normalization (DEF-14178, DEF-14337)
- Added ability to clean serialized content (DEF-11118)
- Fixed bug in MDS for --path (DEF-14179)
- Added tables for MDS scan (DEF-14196)
- Added collecting statistics on suspicious URLs for MDS (DEF-13219)
- Added ability to clean black urls from DB (DEF-13523)
- Added ability to report user ids (DEF-11354)
- Changed users report for --listing (DEF-14401)
- Added param --stat for collection permissions (DEF-14480)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.4.1-1
changelog:
- Improved deobfuscator (DEF-14600, DEF-14515, DEF-14623, DEF-14545, DEF-14466, DEF-14456, DEF-14431)
- Fixed MDS progress (DEF-14632)
- Fixed work with filters (DEF-14703)
- Added fields database_port and app_owner_uid in report (DEF-14443, DEF-14537)
- Changed the way MDS processes symlinks (DEF-14365)
- Added fn b64 encoding to resident mode reports (DEF-14620)
- Added --skip-imunify360-storage option (DEF-13585)
- Added for a non-existent file when cleaning with --forcibly-cleanup option (DEF-14551)
- Added migration for rapidscan db (DEF-14536)
- Added ignore paths in av-admin-paths.txt (DEF-14343)
- Added --rapid-scan-rescan-frequency option (DEF-14374)
- Added RX_SKIPPED_SMART verdict for rapidscan (DEF-14376)
- Changed scan_time instead update_time for rapidscan (DEF-14372)
- Fixed --smart option (DEF-14375)
- Removed AIBOLIT-BINMALWARE.db from ai-bolit and procu2 (DEF-14377)
- Added multiple paths for db scan (DEF-14292)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.4.5-1
changelog:
- Improved deobfuscator (DEF-14702, DEF-14655, DEF-14756, DEF-14782, DEF-14875, DEF-14635, DEF-14818)
- Improved normalization (DEF-14762)
- Changed heuristics algorithm (DEF-14737)
- Fixed bug in report generator (DEF-14956)
- Added field for MDS stat report (DEF-14799)
- Fixed bug in progress (DEF-14820)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.4.6-1
changelog:
- Improved deobfuscator (DEF-14687, DEF-14716, DEF-14942, DEF-14968, DEF-14890, DEF-14904, DEF-15105, DEF-14741)
- Fixed problem with PCRE in deobfuscator (DEF-14687, DEF-14254)
- Fixed bug in smart scan (DEF-15058)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.4.7-1
changelog:
- Improved deobfuscator (DEF-14989, DEF-15126, DEF-14817, DEF-14748, DEF-14924)
- Fixed working with LevelDB for functionality with --rapid-scan-rescan-frequency (DEF-15006)
- Changed malware search algorithm (DEF-15187)
- Fixed bug with SplFileObject (DEF-15193)
- Changed filters for ai-bolit (DEF-15206)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.4.8-1
changelog:
- Improved deobfuscator (DEF-14984, DEF-15200, DEF-14793, DEF-15054)
- Fixed bug with --size (DEF-15261)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.4.9-2
changelog:
- Improved deobfuscator (DEF-15282, DEF-15297, DEF-15309)
- Fixed cleanup bug (DEF-15326)
- Fixed heuristic and suspicious report generation for RapidScan (DEF-15006)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.4.10-1
changelog:
- Changed PDO to native sqlite3 extension (DEF-15369)
- Changed dependency to new package alt-php-internal (DEF-15369)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.6.2-1
changelog:
- Improved deobfuscator (DEF-15425, DEF-14766, DEF-15273, DEF-15609, DEF-15356, DEF-15435, DEF-15119, DEF-15338, DEF-15209, DEF-15260, DEF-15327, DEF-15175, DEF-15083, DEF-15422, DEF-15311, DEF-15152, DEF-15469, DEF-15350)
- Fixed deobfuscator bugs (DEF-15403, DEF-15589)
- Changed default systemd watchdog timeout to 60 sec (DEF-15320)
- Optimized smart scan (DEF-15431)
- Added cloud-assist key in environment variables(DEF-15241)
- Changed PDO to native sqlite3 extension (DEF-15369)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.6.3-1
changelog:
- Improved deobfuscator (DEF-10585, DEF-15771, DEF-15731, DEF-15894, DEF-15913, DEF-15760, DEF-15709, DEF-15779, DEF-15460, DEF-15539, DEF-15631, DEF-15593, DEF-14852, DEF-15550, DEF-15608, DEF-15642)
- Added workaround for skip log php files (DEF-15674)
- Adapted signatures for PCRE 8.38 (DEF-15706)
- Added rescan for procu2 (DEF-9160)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 30.7.1-1
changelog:
- Improved deobfuscator (DEF-15991, DEF-16053, DEF-16026, DEF-16064, DEF-15869, DEF-15903, DEF-15983, DEF-15852, DEF-15815, DEF-15934)
- Enabled smart scan in resident mode (DEF-15981)
- Fixed normalization (DEF-16113)
- Changed url for Go wrapper (DEF-15924)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 30.7.2-1
changelog:
- Improved deobfuscator (DEF-16133, DEF-16157, DEF-16173, DEF-16181, DEF-16194, DEF-16211, DEF-16280)
- Fixed work with broken RapidScan db (DEF-16103)


author: Albek Yermek <ayermek@cloudlinux.com> - 30.8.7-1
changelog:
- Improved deobfuscator (DEF-16598, DEF-16640, DEF-16757, DEF-16599, DEF-16750, DEF-16771, DEF-16734, DEF-16848, DEF-16903, DEF-16886, DEF-16794)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.0.1-2
changelog:
- Improved deobfuscator (DEF-16977, DEF-17053, DEF-17026, DEF-16986, DEF-17095, DEF-17104, DEF-17068, DEF-17113, DEF-17034, DEF-17174, DEF-17170, DEF-17193, DEF-17248, DEF-17262, DEF-17240, DEF-17281)
- Fixed bug with SMW-HEUR-ELF signature name in RapidScan (DEF-16966)
- Fixed a bug with the LevelDB database (DEF-17052)
- Fixed html entities converting after urldecoding (DEF-17134)
- Fixed handling 'bad' chinese chars during normalization (DEF-17111)
- Added separate detached complete messages for separate working modes of MDS (DEF-17066)
- Fixed cleanup of ELF files: always delete ELF without truncating (DEF-17208)
- Added cleanup of logs (DEF-16569)
- Improved cleanup (DEF-17261, DEF-17254)
- Fixed RAS db rescan for heuristic files (DEF-17273)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.0.2-1
changelog:
- Improved deobfuscator (DEF-17295, DEF-17393)
- Added skipping of valid sqlite files when scanning in smart mode (DEF-17330)
- Switched UTF-8 for MDS (DEF-17328)
- Removed AppVersionDetector dependency (DEF-17451)
- Updated EULA (DEF-16810)
- Fixed deobfuscator (DEF-17437)
- Fixed normalization (DEF-17364)
- Fixed cleanup (DEF-17366)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.0.3-1
changelog:
- Improved deobfuscator (DEF-17333, DEF-17363, DEF-17441, DEF-17285)
- Changed shared memory permissions (DEF-17553)
- Fixed deobfuscator (DEF-17365, DEF-17463)
- Fixed normalization (DEF-17511)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 30.9.1-1
changelog:
- Improved deobfuscator (DEF-16598, DEF-16640, DEF-16757, DEF-16599, DEF-16750, DEF-16771, DEF-16734, DEF-16848, DEF-16903, DEF-16886, DEF-16794)
- Fixed filters for big ELF binaries(DEF-16691)
- Fixed a bug with the LevelDB database (DEF-16784)
- Added new performance related fields to json report (DEF-16772)
- Updated required file locations in MDS (DEF-16868)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.1.1-1
changelog:
- Improved deobfuscator (DEF-17416, DEF-17460, DEF-17515, DEF-17565, DEF-17552, DEF-17510, DEF-17537, DEF-17496, DEF-17410, DEF-17520, DEF-17600, DEF-17512, DEF-17475, DEF-17619)
- Fixed MDS detached mode (DEF-17594)
- Added different folders for different modes MDS in detached mode (DEF-17504)
- Added wildcard support in MDS scan --path option (DEF-17593)
- Fixed procu2 --rescan option results (DEF-17688)
- Changed aibolit hyperscan db generation to server side (DEF-17077)
- Changed aibolit hyperscan db serialization to mmap method (DEF-17041)
- Enabled hyperscan in resident mode (DEF-17042)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.8.2-1
changelog:
- Improved deobfuscator (DEF-20165, DEF-20103, DEF-20044, DEF-20203, DEF-20176)
- Added utility to detect SSSE3 and HyperScan support (DEF-19937)
- Added wrapper to run aibolit in resident mode (DEF-19861)
- Added config file for aibolit, to store per-system settings (DEF-19856)
- Added restricted aibolit run with disable_functions option of php (DEF-19859)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.8.3-1
changelog:
- Fixed path in wrapper for hs_support utility (DEF-20367)
- Fixed null file sizes in stats (DEF-20334)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.8.4-1
changelog:
- Improved deobfuscator (DEF-20196, DEF-20145, DEF-20097, DEF-20335, DEF-20417, DEF-20250, DEF-20365, DEF-20469, DEF-20289, DEF-20259)
- Fixed normalization (DEF-20484, DEF-20586)
- Fixed getting server_id from free license (DEF-20535)
- Fixed empty report if it contains invalid chars for json_encode (DEF-20614)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.8.5-1
changelog:
- Improved deobfuscator (DEF-20386, DEF-20485, DEF-20403, DEF-20347, DEF-20294)
- Improved file stat usage during scan (DEF-20128)
- Improved cache usage for stat() function (DEF-20130)
- Improved regexp usage in finder (DEF-20131)
- Improved curl object usage during scan (DEF-20133)
- Removed duplicate filters in finder (DEF-20132)
- Optimized stats collecting (DEF-20852)
- Added caching for function_exists() calls (DEF-20853)
- Adjusted the limit for sequential requests for MDS (DEF-20930)
- Fixed cleanup of escaped bad urls for MDS (DEF-21042)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.8.6-1
changelog:
- Improved deobfuscator (DEF-20117)
- Improved using pathinfo, basename, realpath functions (DEF-20129)
- Fixed MDS issue with posix.so module (DEF-21087)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.9.1-1
changelog:
- Improved deobfuscator (DEF-21309, DEF-21232, DEF-20547, DEF-21139, DEF-20184)
- Fixed MDS bug (DEF-21243)
- Added regexps merging with backreferences (DEF-20967)
- Added processing of white_extended verdicts from CloudAssisted Scan API (DEF-20905)
- Added saving hashes with verdicts in CloudAssisted (DEF-20904)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.9.3-1
changelog:
- Improved deobfuscator (DEF-2125, DEF-20842, DEF-20677, DEF-20677, DEF-21325)
- Fixed jenkins tests and posix bug (DEF-21302)
- Fixed cache overflow bug (DEF-21485)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.10.1-1
changelog:
- Improved deobfuscator (DEF-20729)
- Fixed a bug when scanning a directory with a large number of files with unique extensions (DEF-21642)
- Fixed build script (DEF-21823)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.10.2-1
changelog:
- Improved deobfuscator (DEF-21024)
- Fixed deobfuscator (DEF-21819)
- Changed success list code for resident mode (DEF-21888)
- Fixed incorrect hash getting from LevelDB database (DEF-21717)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.11.2-1
changelog:
- Improved deobfuscator (DEF-20698, DEF-20858)
- Removed AI_HOSTER constant (DEF-21882)
- Added rule for scan crontab files if it system owner (DEF-22272)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.12.1-1
changelog:
- Improved deobfuscator (DEF-22370, DEF-21025, DEF-22589)
- Optimized deobfuscator (DEF-22626)
- Fixed deobfuscator (DEF-22382, DEF-22444, DEF-22590)
- Fixed normalization (DEF-22383, DEF-22591)
- Fixed using cache (DEF-22442)
- Added test for current build (DEF-21880)
- Added version to MDS (DEF-20875)
- Enabled CAS in resident mode (DEF-22320, DEF-22322)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.13.1-1
changelog:
- Improved deobfuscator (DEF-22531)
- Fixed deobfuscator (DEF-22555, DEF-22739, DEF-22750, DEF-22529, DEF-22831, DEF-21736, DEF-22821)
- Fixed normalization (DEF-22738, DEF-22783)
- Added reporting for PCRE errors (DEF-22692)
- Fixed cleanup crontab files (DEF-22342)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.14.1-1
changelog:
- Improved deobfuscator (DEF-20859, DEF-22972, DEF-22948, DEF-22637, DEF-21763, DEF-20745, DEF-20728, DEF-20814, DEF-21990, DEF-20810, DEF-21627, DEF-21628, DEF-20872)
- Fixed normalization (DEF-22946, DEF-22949, DEF-22668)
- Changed cleanup for multi-level obfuscated contents (DEF-22866)
- Added delay for request to CAS (DEF-22997)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.15.1-1
changelog:
- Improved deobfuscator (DEF-20885, DEF-23046)
- Implemented procu2 cloud cleanup (DEF-23237)
- Added extended-suspicious verdict for scan in standard mode and RapidAccountScan (DEF-23170, DEF-23179, DEF-23180, DEF-23330)
- Added Grab data from php-emu log and use it in json report (DEF-23313)
- Changed MRS domain (DEF-23237)
- Added injection verdict (DEF-23236)
- Fixed bug in white_extended verdicts from CloudAssisted Scan API (DEF-23212)
- Changed list from a single signature for extended suspicious signatures (DEF-23383)
- Add Joomla support to MDS (DEF-23353)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.16.0-1
changelog:
- Added more details about cleanup to report (DEF-19852)
- Changed cron signature scanning algorithm (DEF-23239)
- Added auth for CloudAV cleanup (DEF-23511)
- Fixed CloudAV cleanup error (DEF-23538)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.17.0-1
changelog:
- Improved deobfuscator (DEF-23460, DEF-23362)
- Fixed deobfuscator (DEF-23902, DEF-23605)
- Adapted code to PHP 8.2 (DEF-23517)
- Fixed a bug when MDS stopped on a broken table (DEF-23509)
- Changed the process of parsing the config in MDS, it do not take commented lines(DEF-22518)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.18.0-1
changelog:
- Changed algorithm for working with black files in Rapid Account Scan mode (DEF-24063)
- Added new field to MDS report (DEF-24135)
- Changed regexes merge algorithm (DEF-21299)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.19.0-1
changelog:
- Added extended suspicious signatures (DEF-24158, DEF-24272, DEF-24290)
- Changed output algorithm to stdout for MDS (DEF-24489)
- Fixed normalization (DEF-24234)
- Added ability to cleanup multibyte encoded files (DEF-17450)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.19.1-1
changelog:
- Fixed code for support PHP 8.2 (DEF-23972)
- Fixed extended-suspicious id in RAS (DEF-24656)
- Removed extended-suspicious signatures (DEF-24662)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.19.2-1
changelog:
- Fixed URL grabbing (DEF-24810)
- Fixed LevelDB operation (DEF-24903)
- Fixed hash verdicts transfer (DEF-24666)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.2.1-2
changelog:
- Improved deobfuscator (DEF-17715, DEF-17707, DEF-17682, DEF-17654)
- Fixed deobfuscator (DEF-17729)
- Fixed sqlite3 dependencies
- Added malware detection in base64 encoded data for MDS (DEF-16955)
- Added malware detection for cleanup obfuscated black url for MDS (DEF-17779)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.2.2-1
changelog:
- Improved deobfuscator (DEF-17885)
- Improved normalization (DEF-17893)
- Disabled resolving symlinks with glob if no symlink option (DEF-17860)
- Fixed ignore lists skipping if symlinks to / used (DEF-17875)
- Fixed backup creating in MDS (DEF-17934)
- Fixed fallback if no base64 support on mysql server in MDS (DEF-17910)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.2.3-1
changelog:
- Improved deobfuscator (DEF-17769, DEF-17816, DEF-17798, DEF-17727, DEF-17879)
- Added support for doublequotes in wp-config for MDS (DEF-17997)
- Added scan counters when clean used for MDS (DEF-18017)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.2.5-1
changelog:
- Improved deobfuscator (DEF-18046)
- Fixed MDS cleanup report (DEF-18022)
- Fixed MDS scanning by path (DEF-18034)
- Added ai-bolit resident mode upload job zip scanning by param (DEF-17608)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 31.2.6-1
changelog:
- Improved deobfuscator (DEF-17932, DEF-17914, DEF-17905, DEF-17733, DEF-17754)
- Fixed procu2 race condition (DEF-18068)
- Removed MDS hostname resolver (DEF-18117)
- Fixed MDS report detect counters, extending logs (DEF-18089)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.20.1-2
changelog:
- Changed algorithm for creating extended suspicious signatures (DEF-24319)
- Changed algorithm of using whitelist filter with extended-suspicious files (DEF-24819)
- Fixed algorithm for detect log files (DEF-25036)
- Enabled rescan malicious files in RAS (DEF-24922)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.20.2-1
changelog:
- Added ability to extract base64 string for MDS (DEF-25115)
- Fixed cleanup of files with multibyte encodings (DEF-25086)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.20.3-1
changelog:
- Fixed report format (DEF-24985)
- Fixed MDS black url cleanup (DEF-24991)
- Fixed crontab cleaup (DEF-25364)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.20.4-1
changelog:
- Added support for WP tags in MDS (DEF-25440)
- Fixed HashTable implementation (DEF-25518)
- Removed outdated vulnerability detection (DEF-22567)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.20.6-1
changelog:
- Added option for disable CloudAV (DEF-25765)
- Moved deobfuscator patterns to separate file (DEF-25888)
- Changed fast versions deobfuscator regexps for compatible with hyperscan (DEF-25887)
- Fixed bug in procu2 long cleanup (DEF-25843)
- Fixed bug in RAS with long inode (DEF-26030)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.20.7-1
changelog:
- Changed leveldb key logic (DEF-26031)
- Fixed MDS parse escaped config values (DEF-25822)
- Added early-filter Hyperscan DB (DEF-25858)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.21.2-1
changelog:
- Added an exception for the user www-data (DEF-26512)
- Fixed MDS blackurls cleanup (DEF-25817, DEF-26509)
- Added cgroup accounting to aibolit-resident service (DEF-26582)
- Removed UID_MAX restriction (DEF-26918)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.21.3-1
changelog:
- Removed the use of mbstring (DEF-26805)
- Added display_errors=stderr to launch params (DEF-26934)
- Added more error markers to report to sentry (DEF-26799)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.21.4-1
changelog:
- Fixed error with empty resident job file (DEF-27062)
- Fixed warning in procu2.php (DEF-27014, DEF-27104)
- Fixed large memory consumption when finding blacklisted files (DEF-27091)
- Added wake up agent on detection in resident mode (DEF-26667)
- Started using extended-suspicious Hyperscan DB even if Hyperscan is disabled (DEF-26780)
- Managed the hyperscan parameter for the resident mode according to Imunify360 config (DEF-26767)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.21.5-1
changelog:
- Fixed error in cleanup (DEF-27364)
- Changed the file buffer accumulation order for CloudAV (DEF-27247)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.3.1-1
changelog:
- Improved deobfuscator (DEF-17896, DEF-17864, DEF-17845, DEF-17852)
- Fixed imunify_dbscan work on DB scan error (DEF-18241)
- Fixed cleanup (DEF-18131)
- Fixed deobfuscator (DEF-18217)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.4.1-1
changelog:
- Enabled scanning of archives in resident mode (DEF-18032)
- Changed work with parameters that accept paths to files (DEF-18143)
- Fixed MDS url report (DEF-18163)
- Fixed MDS SQL queries (DEF-18189)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.4.3-1
changelog:
- Fixed deobfuscator (DEF-18368)
- Fixed report with big ELF files (DEF-18354)
- Fixed ZIP scanning (DEF-18395)
- Changed ZIP filter (DEF-18389)
- Changed ZIP scanning limits (DEF-18412)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.4.4-1
changelog:
- Improved deobfuscator (DEF-18451, DEF-18290, DEF-18253, DEF-17967, DEF-17998, DEF-18244, DEF-18188, DEF-18353, DEF-18014)
- Added zip folder count limit (DEF-18448)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.4.6-1
changelog:
- Improved deobfuscator (DEF-18325)
- Added WAL mode for sqlite3 (DEF-18461)
- Fixed hyperscan working in resident mode (DEF-18544)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.4.7-1
changelog:
- Changed the limit for sequential requests for MDS (DEF-18604)
- Fixed deobfuscator in unwrapGoto function (DEF-18447, DEF-18551, DEF-18622)
- Fixed syntax error for PHP 7.2 and earlier (DEF-18662)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.5.1-1
changelog:
- Improved deobfuscator (DEF-18390, DEF-18679)
- Fixed deobfuscator work with PHP8 (DEF-18452)
- Fixed deobfuscator (DEF-18755)
- Fixed resident mode (DEF-18750)
- Fixed black URL detection with escaped slashes in MDS (DEF-18655)
- Fixed cleanup inside script tag in MDS (DEF-18657)
- Improved ability to find black urls for MDS(DEF-18660)
- Removed app-version-detector module (DEF-18783)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.5.2-1
changelog:
- Improved deobfuscator (DEF-18732, DEF-18691, DEF-18339, DEF-18712)
- Fixed normalization (DEF-18621, DEF-18848)
- Added resident mode stats (DEF-18696, DEF-18835)
- Fixed bug in procu2.php with trimmed filenames (DEF-18853)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.5.3-1
changelog:
- Improved deobfuscator (DEF-18620, DEF-18136, DEF-18781, DEF-18824, DEF-18856)
- Fixed unexpected MDS output on search-configs (DEF-18897)
- Fixed cyclic cleanuping (DEF-18906)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.6.1-1
changelog:
- Improved deobfuscator (DEF-18941, DEF-19068, DEF-19128, DEF-19073, DEF-19095, DEF-18934, DEF-18971, DEF-18949, DEF-18920, DEF-18961, DEF-18733, DEF-18746, DEF-18791, DEF-18098)
- Fixed normalization (DEF-18946)
- Added memory limit option for MDS (DEF-19230, DEF-18717)
- Added imunify filters for directory checking (DEF-19142)
- Fixed cleanup (DEF-19027)
- Collection of stat on additional fields for MDS (DEF-19014, DEF-19013, DEF-19015)
- Fixed MDS progress percents (DEF-19038)
- Added 0027 umask (DEF-18650)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.6.3-1
changelog:
- Improved deobfuscator (DEF-19026, DEF-19157, DEF-19205, DEF-19203, DEF-19244)
- Fixed normalization (DEF-19266)
- Fixed MDS cleanup for blackurl (DEF-19279)
- Added flag --standard-only (DEF-19192)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.6.4-1
changelog:
- Improved deobfuscator (DEF-19522, DEF-19531, DEF-19513, DEF-19353, DEF-19492, DEF-19420, DEF-19398, DEF-19370, DEF-19308, DEF-19222, DEF-19161, DEF-19195, DEF-19257, DEF-19286, DEF-19273, DEF-19441)
- Added parameter --size for MDS (DEF-19154)
- Added collecting aibolit decisions statistics (DEF-17810, DEF-17811, DEF-17812, DEF-17813)
- Changed limit for cleanup iterations (DEF-19586)
- Changed limits for scan archive and upload jobs (DEF-19395)
- Extended resident mode reporting (DEF-19396)
- Refactoring procu2 and added to restore original permissions after clean (DEF-18135)
- Switched to using the hrtime function to measure performance in aibolit (DEF-19473)
- Fixed MDS in terms of working with different encodings (DEF-19589)
- Fixed cleanup errors (DEF-19349)
- Fixed MDS url parser (DEF-19470)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.6.5-1
changelog:
- Improved deobfuscator (DEF-19635, DEF-19363, DEF-19634, DEF-19602)
- Changed non-blocking socket for MDS (DEF-19644)
- Fixed data format for stats (DEF-19702)
- Fixed bug with AVD DB selecting (DEF-19593)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.6.6-1
changelog:
- Fixed deobfuscator (DEF-19950)
- Expanded aibolit report with files that were scanned for a long time in debug_performance mode (DEF-19928)
- Expanded MDS report with additional_data field (DEF-19985)
- Added checker_size_range_sig_scan checker (DEF-20001)


author: Albek Yermek <ayermek@cloudlinux.com> - 31.7.1-1
changelog:
- Switched to hrtime function for collecting statistics for MDS and Procu2 (DEF-19624)
- Improved deobfuscator (DEF-20018, DEF-19950, DEF-19902, DEF-19808, DEF-19659, DEF-19838, DEF-19650, DEF-19735, DEF-19840, DEF-19682, DEF-19670, DEF-19662, DEF-19760, DEF-19945, DEF-20004)
- Extended DEBUG_PERFOMANCE mode to measure deobfuscation (DEF-19839)
- Expanded aibolit report with files that were scanned for a long time in debug_performance mode (DEF-19928)
- Expanded MDS report with additional_data field (DEF-19985)
- Added checker_size_range_sig_scan checker (DEF-20001)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 31.9.3-1
changelog:
- Improved deobfuscator (DEF-2125, DEF-20842)
- Fixed jenkins tests and posix bug (DEF-21302)
- Fixed cache overflow bug (DEF-21485)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 32.1.5-1
changelog:
- Changed the cleaning algorithm when using cloudav (DEF-27781)
- Fixed MDS cleanup error (DEF-27226)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.6-1
changelog:
- Added CAS check for files being cleaned (DEF-25914)
- Added suspicious scan in resident mode for inotify_jobs (DEF-27522)
- Fixed MDS cleanup error (DEF-27619)
- Fixed CAS with RAS error reporting to Sentry (DEF-27966)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.9-1
changelog:
- Use uniformity in reports (DEF-28429)
- Changed to not use CAS / CloudAV when working with cron files (DEF-28365)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.1.10-1
changelog:
- Fixed allocating memory error in imunify_dbscan.php (DEF-28213)
- Improved grouping of AI-Bolit Sentry events (DEF-28553)
- Fixed MDS Cleanup error (DEF-28634)
- Fixed regex for URL cleanup (DEF-28584)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.7-1
changelog:
- Added support for WordPress postmeta table in MDS (DEF-27350)
- Added mapping file and new signature DB for Patchman (DEF-28172, DEF-28173)
- Changed license check for Cloudways (DEF-28216)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.11-1
changelog:
- Fixed most frequent PCRE errors cause by deobfuscator (DEF-26429)
- Fixed number total objects (rows_count) in MDS report (DEF-28703)
- Changed MDS prefiltering rules to capture PHP opening tags (DEF-28758)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.12-1
changelog:
- Changed size limit for ELF files to 100 MB to include them in cloud assisted scan (DEF-28627)
- Added support for paths containing references to /./ and /../ for MDS (DEF-29081)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.1.14-1
changelog:
- Improved Sentry errors logging (DEF-28661, DEF-29052)
- Improved the normalization process for covering mixed encodings case (DEF-29028)
- Decreased max ELF file size for scanner to 1M (DEF-29344)
- Fixed regular expression for matching nested URLs, reworked logic for determining blacklisted URLs (DEF-29209)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.15-1
changelog:
- Improved URL check against blacklist in MDS (DEF-29000)
- Added more details to MDS error messages (DEF-28941)
- Fixed wildcard handling in MDS scan path (DEF-29352)
- Limited core dump file filtering to big ELF files (DEF-29454)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.1.14-1
changelog:
- Improved Sentry errors logging (DEF-28661, DEF-29052)
- Improved the normalization process for covering mixed encodings case (DEF-29028)
- Decreased max ELF file size for scanner to 10M (DEF-29344)
- Fixed regular expression for matching nested URLs, reworked logic for determining blacklisted URLs (DEF-29209)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.16-1
changelog:
- Added filtering of core dump files during scan (DEF-29484)
- Changed max ELF file size for scanner to 100M (DEF-29750)


author: Martin Krcho <mkrcho@cloudlinux.com> - 32.1.18-1
changelog:
- Make the process for obtaining data for scanning from database more memory efficient (DEF-28660)
- Fix database scanner to handle large number of databases (DEF-30015)


author: Vitalii Rudnykh <vrudnykh@cloudlinux.com> - 32.1.19-1
changelog:
- Added support hash-based ignore list (DEF-30171)
- Fixed fatal error with writing the report to CSV (DEF-30396)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.1.21-1
changelog:
- api.cas.imunify360.com endpoint is now used for all CAS requests. (DEF-30798)
- Enhanced detection logic to identify obfuscated PHP code stored in a database. (e.g., SMW-INJ-27029-php.spam.redi-0). (DEF-30771)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.1.21-1
changelog:
- api.cas.imunify360.com endpoint is now used for all CAS requests. (DEF-30798)
- Enhanced detection logic to identify obfuscated PHP code stored in a database. (e.g., SMW-INJ-27029-php.spam.redi-0). (DEF-30771)
- Increased size limits in real-time. (DEF-29770)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.2.1-1
changelog:
- Removed hardcoded signatures; uses --avdb for external database. (DEF-8270)
- Updated copyright year to 2025. (DEF-31174)
- Added support for Magento 1 and 2 databases for vulnerable tables and fields. (DEF-31333)
- Added extended-suspicious scanning for specific file extensions and detection of zipped PHP files < 10MB (DEF-31412)
- Added scanning for wp_hfcm_scripts and wp_snippet tables in WordPress. (DEF-31527)
- Fixed division by zero error in database restore for single-line cleanup files. (DEF-31523)
- Fixed bug with infinite loop in deobfuscator (DEF-31754)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.2.2-1
changelog:
- Optimized WHITE_EXTENDED verdict handling to avoid unnecessary scans. (DEF-31891)
- Improved MDS scanner to detect non-standard Magento configs. (DEF-32011)
- Fixed skipping of CMS configs files under 2K. (DEF-32011)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.3.1-1
changelog:
- Improved malware cleanup reporting with precise hashes and timestamps. (DEF-19851)
- Extended procu2 report with mtime and hash fields before/after cleanup. (DEF-19852)
- Handled suspicious detections separately for upload consumers (modsec, ossec). (DEF-29483)
- Added support for new patch verdicts from Cloud-Assisted Scan API. (DEF-31902)
- Fixed %preun scriptlet failure in Elevate initramfs during CL8 to CL9 upgrade. (DEF-32217)
- Implemented patching logic in procu2 using CAS API. (DEF-32652)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.4.1-1
changelog:
- Convert UTF-16 encoded files to UTF-8 before cleaning to avoid issues (DEF-29075)
- Fix iconf func support detection (DEF-31028)
- Disable collecting statistic for case where it is not needed (DEF-33854)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.5.2-1
changelog:
- Fixed group of admin tools detections. Added admin tools signatures sanitizing to all reports (DEF-34676)
- Added handling of ambiguity silently by fall-back categor (DEF-34687)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.6.1-1
changelog:
- New MDS Reporting added (DEF-33704)
- Removed chattr -i for ai-bolit Files (DEF-34156)
- Hyperscan crash AiBolitError due to JSONDecodeError fixed (DEF-34584)
- Added reading of /var/imunify360/.sentry_tags to report errors (DEF-34710)
- Added the use the same config settings for different scan types (DEF-34875)
- Improved regex signature optimizer to support Octal escape sequences (DEF-34910)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.7.1-1
changelog:
- Added scan_id tag to the Sentry event (DEF-35144)
- Fixed the "--restore" action to correctly revert not all historical cleanups (DEF-35256)


author: Maksim Klimchuk <mklimchuk@cloudlinux.com> - 32.7.2-1
changelog:
- Procu2 cleanup: fix normalization regression that modified legitimate files. (DEF-35239)
- Return correct error code on failure (shared-memory). (DEF-35347)
- Resident mode: allow admin tools upload when detection is disabled (adminer.php). (DEF-35394)
- Fix --restore-sig-id restoration by creating proper workdir for detached scans. (DEF-35550)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 32.7.3-1
changelog:
- Resident mode: replace SIGTERM with SIGUSR2 for suspicious files. (DEF-35921)
- Optimize DB restore to use the most recent backup. (DEF-36136)


author: Alexey Parfenov <aparfenov@cloudlinux.com> - 4.1.0-1
changelog:
- Add sha256 of scanned files in report (DEF-8047)
- Add an option and ability to scan first N bytes in AI-BOLIT rather than skipping the file (DEF-8124)
- Enable support for \n and \r (and other allowed chars) in the filename (DEF-8129)
- Run procu2.php with custom (specified) signature for instant cleanup (before it's being released in malware db) (DEF-8231)
- Add cloud assisted scan (DEF-8408)
- Add RapidAccountScan mode (DEF-8620)
- Add support for suspicious signatures (DEF-8708)
- Detect ELF (binary) Executables in user's home folders (DEF-8992)
- Deobfuscator improvements
- Minor bugfixes and other improvements


author: Frediano Ziglio <freddy77@angelfire.com>
changelog:
- remove dependency from freetds-unixodbc
- fix field name (Copyright instead of License)
- updated URL


author: Kamil Dudka <kdudka@redhat.com> 7.33.0-1
changelog:
- new upstream release
- fix missing initialization in NTLM code causing test 906 to fail
- fix missing initialization in SSH code causing test 619 to fail


author: Alex71 <nyrk71@gmail.com> 2.1.0-2
changelog:
- put libhpdf.so in the devel package and libhpdf-2.1.0.so in the main one
- removed duplicated README and CHANGES from devel package
- fixed "E: empty-debuginfo-package" with --enable-debug flag in configure
- removed INSTALL file
- added demo/ directory in doc (devel only) as doc


author: Brian Aker <brian@tangent.org> - 1.0.8
changelog:
* Fri Jan  8 2010 Brian Aker <brian@tangent.org> - 0.37
- Modified to be explicit in install include files.


author: Remi Collet <remi@remirepo.net> - 1.3.2-1
changelog:
- update to 1.3.2
- drop multilib header hack
- change URL to https://libzip.org/
- test suite now ok on all arch


author: Matus Honek <mhonek@redhat.com> - 2.4.46-3
changelog:
- MozNSS Compat. Layer: Make log messages more clear (#1598103)
- MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1595203)


author: Matus Honek <mhonek@redhat.com> - 2.4.46-6
changelog:
- Build with LDAP_USE_NON_BLOCKING_TLS (#1594928)
- Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967)


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1-27
changelog:
- ALTPHP-484: Fix SCL prefixes for alt-php
- ALTPHP-486: Don't create SCL prefix if alt-php is not installed


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1-29
changelog:
- Added trigger for cl-Percona56-client and cl-Percona56-shared packages
- ALTPHP-504: Fixed "Couldn't remove prefix /etc/scl/prefixes" error


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.4.8-2
changelog:
- MODLS-741: Make LSCRIU log messages with timestamps
- MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached
- ALTPHP-961: Update litespeed to 7.7 version


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 7.4.16-2
changelog:
- ALTPHP-1053: Update move_override_ini patch
- ALTPHP-1038: Update litespeed log patch
- ALTPHP-1082: Add alt-php-pdo requires for alt-php-mysqlnd and alt-php-firebird


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 7.4.21-3
changelog:
- ALTPHP-1154: Fix libxml requires
- ALTPHP-1156: Get rid of manipulations with enabling extensions (mysqli.so) in default.ini


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-3
changelog:
- ALTPHP-1355: fix linksafe for all sub-packages
- fix rpath for zip extension
- add alt-php74-imunify-leveldb provides


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.4.33-4
changelog:
- Fix for Harden PHP
- CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:1.10.3-1
changelog:
- update PEAR to 1.10.3
- update ArchiveTar to 1.4.2
- update Structures Graph to 1.1.1
- update XML_Util to 1.4.2
- update Console_Getopt to 1.4.1


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.1.17-2
changelog:
- ALTPHP-498: Fixed ability to override parameters with ini_set() that
  were defined via php_value
- ALTPHP-499: Fixed patch for LiteSpeed SIGTERM cleanup


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.1.28-3
changelog:
- revert:
  - add /etc/cl.selector/symlinks.rules for CL
  - recreate handlers for Plesk/
- Fix problem with /etc/cl.selector/symlinks.rules


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.1.28-4
changelog:
- add all extensions in default.ini and disable by default except mysqli.so
- update plesk php hadlers if add new extensions in default.ini
- set "serialize_precision = -1" in php.ini


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.1.33-5
changelog:
- Fix bug #77569: Write Access Violation in DomImplementation
- Fix bug #79078: Hypothetical use-after-free in curl_multi_add_handle
- Fix bug #79282: Use-of-uninitialized-value in exif (CVE-2020-7064)
- Fix bug #79329: get_headers silently truncates after a null byte (CVE-2020-7066)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.1.33-9
changelog:
- Fix bug #61597: SXE properties may lack attributes and content
- Fix bug #74940: DateTimeZone loose comparison always true
- Fix bug #75673: SplStack::unserialize() behavior
- Fix bug #79199: curl_copy_handle() memory leak
- Fix bug #79200: Some iconv functions cut Windows-1258
- Fix bug #79296: ZipArchive::open fails on empty file (libzip 1.6.0)
- Fix bug #79330: shell_exec() silently truncates after a null byte
- Fix bug #79364: When copy empty array, next key is unspecified
- Fix bug #79393: Null coalescing operator failing with SplFixedArray
- Fix bug #79396: setting Date/Time during a forward DST transition
- Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
- Fix bug #79413: session_create_id() fails for active sessions
- Fix bug #79424: php_zip_glob uses gl_pathc after call to globfree
- Fix bug #79465: OOB Read in urldecode() (CVE-2020-7067)
- Fix bug #79468: SIGSEGV when closing stream handle with a stream filter appended


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.1.33-11
changelog:
- Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
- Fix bug #78875: Long variables cause OOM and temp files are not cleaned (CVE-2019-11048)
- Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned (CVE-2019-11048)
- Fix bug #79497: stream_socket_client() throws an unknown error sometimes with <1s timeout
- Fix bug #79503: Memory leak on duplicate metadata
- Fix bug #79514: Memory leaks while including unexistent file
- Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1-6.1
changelog:
- added install trigger for cl-MySQL50-client, cl-MySQL51-client,
  cl-MySQL55-client, cl-MySQL56-client


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1-6.2
changelog:
- added install trigger for cl-MySQL50-shared, cl-MySQL51-shared,
  cl-MySQL55-shared, cl-MySQL56-shared


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1-6.4
changelog:
- ALTPHP-189: call alt-php-mysql-reconfigure.py instead of deprecated
  alt-php-mysql-reconfigure in posttrans section
- add alt-php70-mysql5.7 and alt-php70-mariadb101 requirements


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-26
changelog:
- fix logrotate permissions
- fix install newrelic for php > 7.0
- disable debuginfo and strip binaries


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.2.34-18
changelog:
- CVE-2021-21703: fix error in php fpm shared memory organization leading to privilage escalation
- CVE-2021-21707: fix handling of paths with percent encoded NULL byte


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.2.34-19
changelog:
- ALTPHP-1255: rebuild with removed webp support from php for getting it from alt-ImageMagick
- ALTPHP-1266: update litespeed to 8.0.1


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.2.34-20
changelog:
- ELS-189: Fix for Harden PHP
- CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE
- CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-22
changelog:
- Fix for Harden PHP
- CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
- CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-23
changelog:
- Fix for Harden PHP
- CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 1-13
changelog:
- Update timezinedb to 2019.1 version
- Update mongodb to 1.5.5 version
- Update imagick to 3.4.4 version
- Update dbase to 7.0.0 version
- Update swoole to 4.3.5 version


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 1-17
changelog:
- Update timezinedb to 2019.3 version
- Update xdebug to 2.8.0 version
- Update swoole to 4.4.12 version


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 1-25.2
changelog:
- Improved checking during build process
- Improved build process
- Removed pdo_sqlsrv and sqlsrv from i686 builds


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
- update to 9.2.15 per release notes
  http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
- update to 9.2.18 per release notes
  http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
  http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
  http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
- update to 9.2.21 per release notes
  http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
  http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
  http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
- update to 9.2.22 per release notes
  http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
- update to 9.2.23 per release notes
  http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Toshio Kuratomi <toshio@fedoraproject.org> - 1.9.1-1
changelog:
- Update to upstream 1.9.1 because of security issues with the bundled
  python-pip in older releases.  This is just a quick fix until a
  python-virtualenv maintainer can unbundle the python-pip package
  see: https://bugzilla.redhat.com/show_bug.cgi?id=749378


author: Tomas Orsava <torsava@redhat.com> - 1.10.1-3
changelog:
- Added a patch that shows a custom error message when a FILE passed to
  virtualenv to be used as 'home dir' already exists and is NOT a directory.
Resolves: rhbz#1306513


author: Charalampos Stratakis <cstratak@redhat.com> - 15.1.0-1
changelog:
- Rebase to version 15.1.0
- Disable automatic downloads from pypi on new venv creation
Resolves: rhbz#1461154


author: Anatholy Scryabin <ascryabin@cloudlinux.com> - 3.5.3-1
changelog:
- update Python to 3.5.3
- disable system expat
- refresh patches 55
- remove patches 180, 184, 203, 242


author: Orion Poplawski - 0.23.5-1
changelog:
- Update to 0.23.5
- Macro usage cleanup
- Fix license tag
- Fix line endings
- Remove unneeded shbangs


author: - John Eckersberg <jeckersb@redhat.com> - 3.08-5
changelog:
- Minor tweaks to spec file aligning with latest Fedora packaging guidelines
- Enforce inclusion of libyaml in build with --with-libyaml option to setup.py
- Deliver to %{python_sitearch} instead of %{python_sitelib} due to _yaml.so
- Thanks to Gareth Armstrong <gareth.armstrong@hp.com>


author: Rahul Sundaram <sundaram@fedoraproject.org> - 0.11.6-1
changelog:
- upstream release 0.11.6
- add python3 subpackage. resolves rhbz#949240
- spec file patch from Haïkel Guémar <hguemar@fedoraproject.org>


author: Adam Williamson <awilliam@redhat.com> - 1.0.0-4
changelog:
- python3 build only for Fedora (no python3 in RHEL6 or 7)
- provide python2-cached_property
- guard against #license not being available
- only run tests on F>=22 (tox is too old on everything else)


author: Adam Williamson <awilliam@redhat.com> - 1.2.0-1
changelog:
- new upstream release 1.2.0 (refactoring, bug fixes)
- patch out non-ASCII characters in HISTORY.rst (breaks py3 build in koji)


author: Adam Williamson <awilliam@redhat.com> - 1.3.0-1
changelog:
- new release 1.3.0, drop patch (merged upstream)
- switch to python2-foo / python3-foo package naming


author: Adam Williamson <awilliam@redhat.com> - 1.3.0-2
changelog:
- try to repair the mess I made of package naming:
- # both subpackages now use module name not project name
- # try to ensure all previous names are provided/obsoleted


author: Miro Hrončok <mhroncok@redhat.com> - 2.2.1-1
changelog:
- Updated to 2.2.1
- Introduced Python 3 subpackage (upstream has merged the codebase)
- Removed BuildRoot and python_sitelib definition
- Use python2 macros instead of just python


author: Zbigniew Jędrzejewski-Szmek <zbyszek@bupkis> - 1:2.5.0-1
changelog:
- Update to latest upstream version
- The patch to make dateutil.zoneinfo.gettz() use the system database is dropped.
  Upstream recommends using dateutil.tz.gettz() instead.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 2.7.2-1
changelog:
- Reverted flawed patch for #1051427 (this reintroduces #1052102).
- Spec cleanup (removed rhel < 7 specific stuff).
- Update to 2.7.2.
Resolves: rhbz#1052777


author: Sergio Pascual <sergiopr@fedoraproject.org> - 0.9.3-2
changelog:
- New upstream release (0.9.3)
- Using new python macros
- Disable failling tests (https://github.com/joblib/joblib/issues/278)


author: Dominik Mierzejewski <rpm@greysector.net> - 1.5.1-7
changelog:
- Update to 1.5.2rc2.
- Drop wrong hunk from use-system-six patch.
- Patch new qhull paths on F25+ instead of using sed.
- Rebase failing tests patch.


author: Dominik Mierzejewski <rpm@greysector.net> - 2.0.0-0.1.b4
changelog:
- Update to 2.0.0b4
- Drop upstreamed or obsolete patches
- python-cycler >= 0.10.0 is required
- move around Requires and BRs and sort more or less alphabetically
- don't ship baseline images for tests (like Debian)
- Require stix fonts only when they're not bundled
- disable HTML doc building for bootstrapping 2.0.x series
- relax image rendering tests tolerance due to freetype version differences
- disable some failing tests on aarch64 for now


author: Adam Williamson <awilliam@redhat.com> - 2.0.0-0.7.rc2
changelog:
- Update to 2.0.0rc2
- Fix more big-endian integer issues
- Apply the 'aarch64' test tolerance patch on ppc64 also (it's affected by same issues)
- Tweak the 'i686' test tolerance patch a bit (some errors are gone, some new ones)
- Re-enable test suite for all arches
- Note a remaining quasi-random test issue that causes build to fail sometimes


author: Bohuslav Kabrda <bkabrda@redhat.com> - 1.3.2-2
changelog:
- Add patch for issue https://github.com/nose-devs/nose/pull/811,
which makes tests of python-billiard and python-falcon fail with Python 3.4


author: Tim Flink <tflink@fedoraproject.org> - 1.4.1-1
changelog:
- Removed patch for CVE 2013-2099 as it has been included in the upstream 1.4.1 release
- Updated version to 1.4.1


author: Matej Stuchlik <mstuchli@redhat.com> - 1.5.6-3
changelog:
- Added patch for local dos with predictable temp dictionary names
  (http://seclists.org/oss-sec/2014/q4/655)


author: Kamil Dudka <kdudka@redhat.com> - 7.21.5-3
changelog:
- remove explicit dependency on keyutils-libs (reported by rpmlint)
- update FSF address in COPYING-LGPL (detected by rpmlint)


author: John Morris <john@zultron.com> - 6.2.4-7.280svn20130805
changelog:
- Update to SVN r280 for python3 compatibility
- Update python-pycxx-6.2.4-setup.py.patch to apply correctly
- Fix %setup for SVN zipball
- Add diff extensions to %patch macros
- Enable python3 pkg by default except for EPEL; see BZ 991342


author: Eduard Chiganov <echiganov@cloudlinux.com> - 0.14.11-10
changelog:
- ALTPYTH-467: Get rid of alt-python dependencies errors.
- New linksafe post, triggerin and triggerun scripts.


author: Ralph Bean <rbean@redhat.com> - 1.5.6-4
changelog:
- Change our conflicts on python-SocksiPy to an obsoletes/provides.
  https://bugzilla.redhat.com/show_bug.cgi?id=1334407


author: Ralph Bean <rbean@redhat.com> - 2.7.0-6
changelog:
- Replace the provides macro with a plain provides field for now until we can
  re-organize this package into two different subpackages.


author: Ralph Bean <rbean@redhat.com> - 2.7.0-7
changelog:
- Tell setuptools about what version of urllib3 we're unbundling
  for https://github.com/kennethreitz/requests/issues/2816


author: Jamie Lennox <jamielennox@gmail.com> - 0.7.0-1
changelog:
- Update package to new version.
- Add python2 subpackage for new python packaging guidelines.
- Redo patch1 to still apply.


author: Thomas Spura <tomspur@fedoraproject.org> - 0.16.1-3
changelog:
- Add patch to fix ctypes test
- Move requires to correct python2 subpackage
- Add FFLAGS also in %install


author: Björn Esser <besser82@fedoraproject.org> - 0.16.1-4
changelog:
- Discard results of testsuite on %{arm} for now
  Segfaults on non-aligned memory test (expected for arm)


author: Lumír Balhar <lbalhar@redhat.com> - 1.15.6-3
changelog:
- Add subpackage for platform-python
- Disable tests so platform-python stack can be bootstrapped
  (https://fedoraproject.org/wiki/Changes/Platform_Python_Stack)


author: Tomas Orsava <torsava@redhat.com> - 1.15.6-4
changelog:
- Re-enable tests to finish bootstrapping the platform-python stack
  (https://fedoraproject.org/wiki/Changes/Platform_Python_Stack)


author: Ralph Bean <rbean@redhat.com> - 1.15.1-2
changelog:
- Remove broken symlinks to unbundled python3-six files
  https://bugzilla.redhat.com/show_bug.cgi?id=1295015


author: Michal Ambroz <rebus at, seznam.cz> - 3.5.0-5
changelog:
- testModuleData is failing on arm platform even for python 2.7
- exclude this test for build of arm


author: Michal Ambroz <rebus at, seznam.cz> - 3.5.0-6
changelog:
- additionally testEntrypoint testIn testIntegerFunctions failing on s390/ppc64
- exclude those tests for build of s390/ppc64


author: Sergey Fokin <sfokin@cloudlinux.com> 3.8.12-2
changelog:
- ALTPYTH-413: move -fno-semantic-interposition to CFLAGS_NODIST
- remove changing gcc to devtoolset-gcc
- change BuildRequire from gcc-toolset to system gcc for CL8


author: Eduard Chiganov <echiganov@cloudlinux.com> - 4.2.0-3
changelog:
- ALTPYTH-474: Change specs for alt-python for new linksafe add method.
- Created patch for unit tests.


author: Thomas Moschny <thomas.moschny@gmx.de> - 1.4.28-1
changelog:
- Update to 1.4.28.
- Modernize spec file.
- Apply updates Python packaging guidelines.
- Mark LICENSE with %license.


author: Thomas Moschny <thomas.moschny@gmx.de> - 1.4.31-1
changelog:
- Update to 1.4.31.
- Follow updated Python packaging guidelines.
- Add Provides tag for bundled apipkg.


author: Julian Sikorski <belegdol@fedoraproject.org> - 11.1.0-1
changelog:
- Updated to 11.1.0
- Obsoleted zsh subpackage (upstream ticket #3078)
- mktap is gone (upstream ticket #5293)
- Dropped obsolete Group, Buildroot, %clean and %defattr


author: Jan Stanek <jstanek@redhat.com> - 3.7.16.2-1
changelog:
- update to 3.7.16.2 (http://www.sqlite.org/releaselog/3_7_16_2.html)
- add support for aarch64 (rerunning autoconf) (#926568)


author: Panu Matilainen <pmatilai@redhat.com> - 3.7.15-1
changelog:
- update to 3.7.15 (http://www.sqlite.org/releaselog/3_7_15.html)
- fix an old incorrect date in spec changelog


author: Jaroslav Škarvada <jskarvad@redhat.com> - 5.1.2-6
changelog:
- Resolves: #556398
- Directly included relevant patches, scripts and man pages from Debian
- Removed rpath
- rpmlint is silent now


author: Jaroslav Škarvada <jskarvad@redhat.com> - 5.1.2-6.1
changelog:
- Fixed CVE-2010-2642, CVE-2011-0433, CVE-2011-0764, CVE-2011-1552, CVE-2011-1553, CVE-2011-1554
  Resolves: rhbz#772900


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.1102-1
changelog:
- Fixed normalization for versions (DEF-14069)
- Changed behavior for non-existent directories (DEF-14117)
- Fixed bug in read directories by function file_get_contents (DEF-14047)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.1117-1
changelog:
- Fixed output on empty input (DEF-14770)
- Added real_path field for slite report (DEF-14365)
- Added uid field for slite report (DEF-13657)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 20.1117-1
changelog:
- Fixed output on empty input (DEF-14770)
- Added real_path field for sqlite report (DEF-14365)
- Added uid field for slite report (DEF-13657)


author: Ilia Gorchakov <igorchakov@cloudlinux.com> - 21.0908-1
changelog:
- Fixed script for update AppVersionDetector package (DEF-17661)
- Fixed return code (DEF-17662)
- Added detection for phpmyadmin (DEF-10502)
- Added detection for Modx, IPB, PHPBB3, OsCommerce and Bitrix (DEF-10501)
- Added PHP 8.0 support (DEF-17446)
- Changed EULA (DEF-17426)


author: Maxim Kanushin <mkanushin@cloudlinux.com>, Igor Savenko <bliss@cloudlinux.com> 2.1-1
changelog:
- Storing username and timestamp for R1Soft
- DEF-4318: Info method for R1Sort & Acronis backends
- Fixed current host IP address retrieval for R1Soft backend
- DEF-4308 Add running unit tests on gerrit commit for backup-utils project
- DEF-4350 Fix skipped tests for cloudlinux-backup-utils
- DEF-3996 Make unittests for acronis backup progress tracking functionality


author: Alexander Zveruk <azveruk@cloudlinux.com> 2.2.1-1
changelog:
- DEF-4429 restore_infected - TypeError: 'coroutine' object is not iterable
- DEF-4430 Async call to restore infected blocked during inital backup


author:
Alexander Tishin <atishin@cloudlinux.com>, Alexander Zveruk <azveruk@cloudlinux.com>, Maxim Kanushin <mkanushin@cloudlinux.com> 3.0-1

changelog:
- DEF-4659 Do not suppress error output of `mysql` command
- DEF-4712 Fix endpoint decorators
- DEF-4625 RestoreInfected should support centos-plus kernels
- DEF-4637 `kernel-devel is not installed` during Acronis installation
- DEF-4507 Implement DirectAdmin backup backend
- DEF-4546 Agent should install Acronis client if it's not installed yet
- DEF-4494 Acronis backup - `show` before `init` leads to "Could not read token" error
- DEF-4528 Refresh timestamp stored for R1Soft on token refresh
- DEF-4475 Don't fail on broken backups
- DEF-4474 Make a cron job for R1Soft to keep token valid


author: Alexander Zveruk <azveruk@cloudlinux.com>, Alexander Tishin <atishin@cloudlinux.com> - 3.0.3-1
changelog:
- DEF-3830 Status update for user when activating Cloudlinux Backup
- DEF-4908 Register server in Acronis during init if agent already installed


author: Alexander Tishin <atishin@cloudlinux.com>, Maxim Kanushin <mkanushin@cloudlinux.com> - 3.1.0-1
changelog:
- DEF-4956 Rotate MySQL freeze/unfreeze log
- DEF-4921 User-friendly error when using wrong acronis credentials
- DEF-4938 Change default options of "CloudLinux Backup" plan


author: Maxim Kanushin <mkanushin@cloudlinux.com> - 3.1.1-1
changelog:
- DEF-5125 'hide' the log about "skipping" in result of cron task cloudlinux-backup-utils-cron-daily.sh


author: Alexander Tishin <atishin@cloudlinux.com> - 3.1.2-1
changelog:
- DEF-5092 TypeError in Ftp.__init__
- DEF-5270 Fix Acronis agent existence check
- DEF-5289 Fix Acronis registration
- DEF-4938 Change default options of "CloudLinux Backup" plan
- DEF-5273 No backup listed after successful manual backup
- DEF-5293 Backup is not scheduled after init


author: Maxim Kanushin <mkanushin@cloudlinux.com> - 3.2.0-1
changelog:
- DEF-5359 Implement ClusterLogics backup backend
- DEF-5739 Make possible to restore from backup in multiple threads
- DEF-5906 Verbositiy setting in cloudlinux-backup-utils CLI
- DEF-5166 Make BackupException human-readable


author: Alexander Tishin <atishin@cloudlinux.com> - 3.3.3-1
changelog:
- DEF-10693 Unable to access backups using Imunify360 panel
- DEF-10848 module 'restore_infected.cli' has no attribute 'main'


author: Alexander Tishin <atishin@cloudlinux.com> - 3.4.0-1
changelog:
- DEF-6026 Fix the file descriptor leakage when using Cpanel Backup
- DEF-9279 Remove Acronis agent if it was installed by us. Do not ask in i360deploy.sh
- DEF-8545 Fix error when Plesk uses plain passwords for FTP
- DEF-11629 TypeError: join() argument must be str or bytes, not 'NoneType'
- DEF-12005 ValueError: list.remove(x): x not in list
- DEF-12116 Restore from backup leaves temporary directory on Directadmin and Plesk


author: Alexander Tishin <atishin@cloudlinux.com> - 3.4.1-1
changelog:
- Fix Plesk FTP backup Attribute error
- DEF-12727 Fix Acronis 'usage'
- DEF-12683 Make Acronis' backup listing an error-tolerant


author: Alexander Tishin <atishin@cloudlinux.com> - 3.5.0-1
changelog:
- DEF-7346 Add flag/config to disable FTP backups processing
- DEF-12736 Check if we have enough space before any FTP download
- DEF-12737 Delete FTP backups archive on close
- DEF-12738 Add ability to specify a custom directory for FTP downloads
- DEF-12893 Add User Agent for Acronis backend requests


author: Egor Zvorykin <ezvorykin@cloudlinux.com> - 3.6.0-1
changelog:
- DEF-13839 Acronis backup should be able to restore more than 100 files
- DEF-14070 Fix ValueError: commonpath() arg is an empty sequence
- DEF-13970 cloudlinux-backup-utils: async_check blocks the loop
- DEF-13602 Support restoring files with the same name in a single batch
- DEF-13475 Restore multiple files: Acronis
- DEF-13953 Wrong login redirect URL
- DEF-13687 Fix permissions for logrotate / cloudlinux-backup-utils
- DEF-13472 Cache request results in AcronisRestoreSet._get_path_item
- DEF-13116 Purge cron and logrotate configs after removing on Ubuntu


author: Maksim Kanushin <mkanushin@cloudlinux.com> - 3.7.0-1
changelog:
- DEF-12242 Update to support Python 3.8
- DEF-14845 Fix Acronis backup/plans API response processing


author: Alexander Tishin <atishin@cloudlinux.com> - 3.7.1-1
changelog:
- DEF-14562 improve test coverage up to 75 percents
- DEF-15076 cloudlinux-backup-utils: raise a special exception on unauthorized error for Acronis


author: Alexander Tishin <atishin@cloudlinux.com> - 3.9.0-1
changelog:
- DEF-18719 Add zstd compressed tar support
- DEF-19309 Include non-client domains to backup list on Plesk when user filter is applied


author: Igor Savenko <bliss@cloudlinux.com> 0.2-5
changelog:
- Bugfix: Make cloudlinux-file-change-collector PID file non-world writeable
- Bugfix: fixed log write sentence


author: Igor Savenko <bliss@cloudlinux.com> 0.3-3
changelog:
- DEF-17485: Adjust default config values
- DEF-17484: Inner reader should flush all events it read from the buffer


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1-1.11.1
changelog:
- Added hook for fixing Plesk work with enabled linksafe protection
- Fixed work of linksafe configuration for 2.6.18 kernel
- Fixed creation of fs.protected_*links_create parameters in /etc/sysctl.conf
- Fixed fs.protected_* parameters cleanup during package uninstallation


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1-1.20
changelog:
- AL-2064: Add psaadm user to linksafe group on Plesk Onyx
- AL-2069: Fix alt-* packages files permissions correction


author: Stepan Oksanichenko <soksanichenko@cloudlinux.com> - 1-1.22
changelog:
- CAG-714: cloudlinux-linksafe package should turn off symlink traversal protection by default. Part II


author:
Stas Django <ssergiienko@cloudlinux.com>, Stepan Oksanichenko <soksanichenko@cloudlinux.com> - 1-1.23

changelog:
- CAG-833: /scripts/postupcp issue (cloudlinux-linksafe?)
- LU-482 Added root permission check to cl-linksafe-reconfigure


author:
Igor Savenko <bliss@cloudlinux.com>, Alexander Tishin <atishin@cloudlinux.com>, Maxim Kanushin <mkanushin@cloudlinux.com> 1.0-1

changelog:
- Fixed R1Soft issues, updated tests
- Added R1Soft backup backend
- Added Restore Functionality for Acronis
- Added Restore Functionality for cPanel
- Added Restore Functionality for Plesk


author: Alexander Tishin <atishin@cloudlinux.com>, Igor Savenko <bliss@cloudlinux.com> 1.0-3
changelog:
- DEF-3234: Add support for non-customer backups. Skip 'no hosting' domain backups
- DEF-3244: Added recovery backend for Acronis to keep original file owner and permissions


author: Nikolay Telepenin <ntelepenin@cloudlinux.com> - 2.2-16
changelog:
- DEF-2009 Handle CWAF plugin installation conflicts
- DEF-1946 filter modsec_audit.log errors
- DEF-2029 DEF-1645 new ossec rules for cpanel
- Fixup is_valid_license() in sensor


author: Telepenin Nikolay <ntelepenin@cloudlinux.com> 2.2-21
changelog:
- DEF-2130 Incidents sort limited by: "List->gray" in i360 GUI have both blue and gray colored IP a...


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> - 2.2-24
changelog:
- Fix "thumb up" icon in sensor
- DEF-2180 Do not start sensor when installed
- DEF-2180 .rpm rename: imunify360-sensor to cloudlinux-sensor
- DEF-1922 Fixed bug in domain list
- DEF-2133, DEF-2149, DEF-2148, DEF-2140, DEF-1176, DEF-1750 OSSEC rules fixes and improvements


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> - 2.2-26
changelog:
- DEF-2242 Fix whitelisted IP is filtering
- Fix "thumb up" icon in sensor
- DEF-2180 Do not start sensor when installed
- DEF-2180 .rpm rename: imunify360-sensor to cloudlinux-sensor
- DEF-1922 Fixed bug in domain list
- DEF-2133, DEF-2149, DEF-2148, DEF-2140, DEF-1176, DEF-1750 OSSEC rules fixes and improvements


author: Antonio Trande <sagitter@fedoraproject.org> - 3.11.0-1
changelog:
- Update to cmake-3.11.0
- Add libuv rhash development packages
- Adapt 'cmake3-rename' patch to CMake-3.11
- Move appdata file into the metainfo sub-data directory


author: Jason Taylor <jtfas90@gmail.com> - 0.13.0.5-1
changelog:
- Upstream bugfix release
- Correction to spec license add MIT license
- Added asciidoc BuildRequires and docdir files


author: Orion Poplawski <orion@cora.nwra.com> 1.8.12-5
changelog:
- Use parallel make
- Limit number of processors to 4 in parallel tests to avoid mpich issue with
  oversubscription


author: Orion Poplawski <orion@cora.nwra.com> - 1.8.12-6
changelog:
- Add patch to add ppc64le to config.guess (bug #1080122)
- Add patch to fix long double conversions on ppc64le (bug #1078173)
- Run autoreconf for patches and to remove rpaths


author: Alexander Tishin <atishin@cloudlinux.com> 3.8.5-11
changelog:
- DEF-6755 Fix ignore for malware_hashes in on-demand scan
- DEF-6550 Fix error with previous scans
- DEF-6616 Fix issue with creating a temporary file in /var/imunify360/tmp/ during a malware scan
- DEF-6230 Fix "too many SQL variables" error when deleting malicious records
- DEF-6092 Fix FileNotFoundError in scan.py/_need_to_scan
- DEF-6541 Disable ClamAV false-positives in ImunifyAV
- DEF-6607 Invalidate i18n files cache with every new release
- DEF-6262 Disable logging of whitelisted files by hash filter
- DEF-6539 On-demand malware scan start should wait until scan is started
- DEF-6132 Use alt-python35 linked with alt-sqlite
- ICPD-82 Make job for starting all stages of test process for php_i360
- DEF-6550 Fix on_demand.symlinks RPM-test
- DEF-6627 Fixture "malware_sample" called directly.
- DEF-6242 Fix features error
- DEF-6355 RPM-tests for on-demand queue and user list


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.10.1-1
changelog:
- DEF-13218 RuntimeError: Symlink loop from '/home/imadco1'
- DEF-13122 [AI-BOLIT] deobfuscator can't deobfuscate the sample 16af7e9809a2f631f9a1e3b3d7c4a849926bef8e5a4536907f433f9979e0b250
- DEF-13211 [AI-BOLIT] Cleaning breaks the Bitrix site
- DEF-13321 Exclude index.php only for Standalone malware execution (10001 4.9.6 and 11001 4.10.1+)
- DEF-13176 [AI-BOLIT] Imunify 360 - php killed by SIGABRT ()
- DEF-13204 [AI-BOLIT] php killed by SIGABRT
- DEF-13249 Migration 145_move_quarantine failed with FileNotFoundError
- DEF-13266 Can't get attribute 'State' error


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.10.2-1
changelog:
- DEF-13404 Allow installing HardenedPHP on Oracle Linux
- Bump specs to imunify360-php-i360-4.10.0-1.14, imunify360-php-i360-rules-4.10.0-7
- DEF-13281 reproduce the "concurrent reset" issue
- DEF-13281 guard against a concurrent cache reset
- DEF-13357 test_malware.test_user_list.test_scan_status rpm test failed
- DEF-13224 test_files_downloaded_file_by_file_corrupted_file may hang indefinitely
- DEF-13207 test_ondemand_scan rpm test fails on multiple configurations
- DEF-13361 malware user list shows the first scan date instead of the last
- DEF-13190 Fix test_remoteip on configurations with cPanel


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.2.3-3
changelog:
- DEF-8768 Fix lsof pat
- DEF-8838: bump aibolit to 4.0.2-1
- DEF-8420 Use koji repository in e2e tests to prevent issues related to gradual rollout


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.2.7-1
changelog:
- DEF-9022 Allow 'week' and 'day' for MALWARE_SCAN_SCHEDULE.interval in AV+
- DEF-9352 Implement --intensity which is joint of --intensity-cpu and --intensity-io


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.3.2-1
changelog:
- Bump AI-BOLIT version to 4.1.2-3
- DEF-9587 TypeError: <bound method MalwareAction.quarantine_hits_detect of <class 'im360.malwarelib.subsys.malware.MalwareAction'>> is not JSON serializable
- DEF-9619: Enabled rapid scan in RPM tests
- DEF-9554 Migration failed: 128_move_cleanup_storage_files (fix 2)


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.3.3-2
changelog:
- DEF-9640 important fix
- DEF-9593 `malware on-demand status` - `progress` is broken
- DEF-9616 Fix modsec scan triggers on suspicious


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.3.4-2
changelog:
- DEF-9575: process suspended support request
- DEF-9611: Add imunify-antivirus activity to daily cron task


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.3.6-1
changelog:
- DEF-5818 Fetching incidents is slow when using LIST filter
- DEF-9770 Upgrading to 4.3 seems to be kind of “intrusive” when upgrading
- DEF-9762 Add a config parameter that specifies the upper limit for the scanning file by Malware Scanner
- DEF-9763 [AI-BOLIT] Add separate CLI parameter for AI-BOLIT for cloud-assisted scan
- DEF-9792 Uncaught exceptions should be logged
- DEF-9794 init_actions should not be used for non-critical tasks
- DEF-9824 Restrict DB table malware_scans in size/ update 125 migration


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.3.7-1
changelog:
- DEF-9889 UnicodeDecodeError in 125_rescan_scan_type migration (a broken update to stable 4.3.6-1?)
- DEF-9770 ImunifyAV login page shows Imunify360 logo


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.3.9-1
changelog:
- DEF-9884 KeyError in _store_scan
- DEF-10052 [AI-BOLIT] Bitrix file is removed instead of cleaning
- DEF-10072 Imunify360 config does not match the scheme: ValidationError({'MALWARE_SCAN_SCHEDULE': [{'interva...
- DEF-10085 Switch sqlite to use /var/imunify360 as a temporary directory


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.3.10-3
changelog:
- DEF-10096 Show all accounts in Imunify360 Feature management
- DEF-10176 fix modsecurity ruleset update for cPanel
- DEF-10124 notify systemd during migration


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.3.11-3
changelog:
- DEF-10467 Wrong symlink to malware_found.list on fresh install Centos6 cpanel
- DEF-10075 [Response validation] 'running' is not one of ['stopped']
- DEF-10328 Suspicious files are not uploaded to IRMA (no uploaded events in mrs_events table)
- DEF-10429 Do not set umask during agent start on CentOS6


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.4.1-1
changelog:
- [DEF-9787] - IntegrityError: UNIQUE constraint failed: iplist.network_address, iplist.netmask, iplist.version
- [DEF-10311] - error: bad character range 9-0 at position 84
- [DEF-10328] - Suspicious files are not uploaded to IRMA (no uploaded events in mrs_events table)
- [DEF-10429] - Do not set umask during agent start on CentOS6
- [DEF-10431] - cPanel service manager restarts agent during migration
- [DEF-10467] - Wrong symlink to malware_found.list on fresh install Centos6 cpanel
- [DEF-10279] - imunify360: Add hard timeout for whole modsec script execution
- [DEF-10466] - Add a link to low resource mode docs
- [DEF-10472] - Update text description in the UI


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.4.3-2
changelog:
- DEF-10596 Handle expired AV+ license in UI
- DEF-10469 AI-BOLIT supports new hash API format with verdicts


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.4.4-2
changelog:
- DEF-10643 limit number of workers for default executor
- DEF-10672 TypeError: sequence item 1: expected str instance, int found
- DEF-10645 test_cloud_assisted_scan fails
- DEF-10616 ImunifyAV memory consumption increased


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.5.1-2
changelog:
- DEF-10835 Fix /var/imunify360/aibolit/run/*/pid: No such file or directory
- DEF-10956 Security fix


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.6.1-1
changelog:
- DEF-11306 master.test_malware.test_detached_scan_messages.test_malware_scan_messages_order[ordinary]


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.7.0-3
changelog:
- DEF-11443 Do not enable/disable agent in systemd during registration
- DEF-11542 Handle php parameters in ai-bolit go-wrapper
- DEF-11543 ai-bolit wrapper: data collector paths mismatch
- DEF-11611 Cleanup fails due to permissions of /var/imunify360/files/sigs/v1/aibolit/procu2.db
- DEF-10853 Improve ionice management for the schedulers deadline and noop while running AI-BOLIT
- DEF-10997 Update defaults for malware scanner settings for new installation
- DEF-10438 [AI-BOLIT] PHP data collection script
- DEF-10854 UI - add warnings if none of the limitation mechanics are supported
- DEF-10891 Agent - return warnings if none of the limitation mechanics are supported
- DEF-11010 Update defaults for malware scanner settings
- DEF-11134 Provide ability to set limitations via LVE
- DEF-11240 Update config file atomically
- DEF-11319 Remove “Experimental” under Rapid Scan and update text
- DEF-11448 Implement RPM test for scan intensity
- DEF-11452 Install lve-wrappers automatically
- DEF-11529 Use go-wrapper for AI-BOLIT
- DEF-11530 Add executable bit to wrapper binary
- DEF-11670 Integrate ai-bolit 20.0325


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.7.1-4
changelog:
- DEF-11774 Use intensity settings from config as default to scan
- Bump ai-bolit version
- DEF-11632 Standalone ImAV has only 3 tabs in UI ( Files, History, Ignore list)


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.8.0-5
changelog:
- DEF-11436 Plesk backups say "some minor issues occurred" due to permissions errors on file: .rapid-scan-db
- DEF-11808 Security Message on Plesk due to /httpdocs/wp-content/.rapid-scan-db owned by "root"
- DEF-10126 Failed to parse cleanup report: b'Loaded External DB
- DEF-10432 OperationalError: user-defined function raised exception
- DEF-10625 master.test_malware.test_cleanup.test_cleanup_not_blocking
- DEF-11268 KeyError: 'getpwuid(): uid not found: 100'
- DEF-11275 Change progress tracking from finder to ai-bolit wrapper
- DEF-11577 KeyError: 'MALWARE_SCANNING'
- DEF-11604 SocketError: Socket for root not found.
- DEF-11616 Error during registration when agent is not started
- DEF-11662 test_malware_scan_task fails on Ubuntu + Plesk
- DEF-11743 Detect crashed detached scan
- DEF-11753 LicenseError: ImunifyAV+ license required
- DEF-11794 FileExistsError: [Errno 17] File exists: '/var/imunify360/aibolit/run/177357b34f11468b97c9a03a1683a927'
- DEF-11847 malware tests failed on AV (rpm-tests)
- DEF-11879 test_detached_scan_messages.test_malware_scan_messages_order failed
- DEF-11923 total_files always 0 from malware on-demand list output
- DEF-11924 ValueError: invalid literal for int() with base 10: '12.5'
- DEF-11938 test_hooks failed (RPM-tests)
- DEF-11990 'user list' shows that user has no malware when malware exists, after interrupted scan
- DEF-12138 UnicodeDecodeError: 'utf-8' codec can't decode byte 0x89 in position 0: invalid start byte
- DEF-10639 [AI-BOLIT] Scan List Preparation inside ai-bolit
- DEF-11233 Make clean-up results visible and clear for customers
- DEF-10875 Need to make in Agent the switcher for using the internal scan list of files and externa(ai-bolit)
- DEF-11357 Parametrize existing tests of on-demand scan to use internal/external finder
- DEF-11358 Write test to cover external finder
- DEF-11415 Hide "Upgrade" button in ImunifyAV via some option or parameter
- DEF-11460 Update user's infected count only on user scan
- DEF-11544 Probable race condition while cleaning up files
- DEF-11719 Remove 'filelist' fixture from RPM-tests
- DEF-11921 Add AI-BOLIT stderr/stdout to MalwareScan report for debug purposes
- DEF-11985 Change MRS size limit exceeded error to warning
- DEF-12040 test_ondemand_queue.TestQueueRemove.test_remove_any fails


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.8.3-2
changelog:
- DEF-9832 Exclude lightspeed cache folder from the list of scan folders
- Remove *.config and *.cfg files from ignored


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.8.4-1
changelog:
- DEF-12669 Remove clamav from /etc/cagefs/cagefs.mp
- DEF-12661 TypeError: unorderable types: NoneType() > int()


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.9.0
changelog:
- DEF-11677 Increase startup waiting timeout
- DEF-12669 Remove clamav from /etc/cagefs/cagefs.mp
- Bump ai-bolit version to 20.0601
- DEF-12661 TypeError: unorderable types: NoneType() > int()
- DEF-12635 Enable imunify360 service on every update
- DEF-12500 Enable webshield-related rpm tests for generic panel
- DEF-12627 Split cleanup file list by chunks
- DEF-12274: Put realtime av scanner configs to files server
- DEF-12455 add pytest-rerunfailures pytest-plugin
- DEF-12609 Do not add koji repo for CL8
- DEF-12387 Issues with Imunify uninstall
- DEF-12575 Wait users to be removed from packages
- DEF-12578: Fix validation error on RULE_DISABLED msg
- DEF-9832 Exclude lightspeed cache folder from the list of scan folders
- DEF-12514 several test_socket_activation rpm tests failed on multiple configurations
- DEF-11268 KeyError: 'getpwuid(): uid not found: 100'
- DEF-9502 Add unit test for deploy.sh
- DEF-12437: Add body size to correlation middleware metric
- DEF-12323 increase count of attempts in test ossec_pam integration
- DEF-12238: Prepare MRS for increased load
- DEF-12524 Implement a rotation for CAPTCHA keys
- DEF-12140 WebShield: add save new CAPTHA keys in agent's config. New UI fields
- DEF-12288: persistent messages that are sent via Correlation UI are not delivered sometimes DEF-12288: Temporarely disable connection from limiting traffic
- DEF-12339 Updated eula
- DEF-11797 switcher for json/csv format of ai-bolit reports
- DEF-12323 add rpm test to check ossec/pam integration (sshd)
- DEF-12548 Remove some experimental badges in UI
- DEF-12575 Remove account before package
- DEFA-2606 Greylisting if AR and PAM are disabled. ossec 3.1.0-74
- DEF-11931: Fix adding field to the wrong table
- DEF-12486 Fixed test_dos_detector
- DEF-12001 fix fields order in migration 143
- DEF-12497 Update of Imunify360-firewall resets backup settings
- DEF-12449 add timeout to SendMessageAPI
- DEF-11291 Fix 'cmd' appears instead of 'args' for cleanup
- DEF-9502 Update panel detection in deploy.sh
- DEF-9612 [Sentry] `get-news` throws an error: "ParseError no element found: line 1, column 0"
- DEF-12494 Fix ui e2e tests
- DEF-12493 Make create_build.py work with new release pointers
- DEF-12495: Add `system_id` field to the `/api/app-version-save` endpoint
- DEF-12484: Update and enable dashboard recommendations
- DEF-12454 New Caledonia Icon Flag Broken in IM360 UI
- DEF-12265: Create /api/ip endpoint
- DEF-12261 Added ossec-remoted to csf.pignore
- DEF-11290 Fix 'default_action' and 'try_restore' appears in wrong place
- DEF-11289 Fix 'cmd' appears instead of 'args'
- DEF-12303 Change core version for Centos8 to support by kernelcare
- DEF-12023 use machine readable format in extra_repos
- DEF-12383 Warning in UI / Settings
- DEF-11822 Do not acquire CSF lock for rules check
- DEF-12416 LogReader should not write to console.log
- DEF-12434: Add src_ip to xray requests and tables
- DEF-12429 Update ignored regexps
- DEF-12360 config.py defaults of rapid_scan and schedule interval should match imunify360.yaml
- DEF-12271: Add verdicts on MRS to monitoring
- DEF-12342 Do not fail installation if install-vendors fails
- DEF-11904 Create rpc methods for enduser scan - cover with agent unit tests
- DEF-12366 Imunify360 UI wont save changes to "Max Connections" & "Check delay" under Settings > General > DoS Protection
- DEF-12250: Add license field in correlation API send-message endpoint
- DEF-12414: Add jwt token check for xray
- DEF-12208 add logging and finally_happened to first check in test_sa_hacker_trap_included
- DEF-12456 Skip test_atomic_reload_custom_iplist for antivirus mode
- DEF-12310 add basic integration test
- DEF-12352 ValueError: invalid literal for int() with base 10: ''
- DEF-11839 on-demand scan removes previously detected malware hits
- DEF-12319 AttributeError: 'NoneType' object has no attribute 'process_message'
- DEF-11937 Use swap to reset ipsets atomic
- DEF-12324 Show a warning and disable "SMTP Traffic Management" in UI if a similar feature is provided by hosting panel
- DEF-11195: src/smart-block reformat
- DEF-12396 CentOS 8/CLOS 8/RHEL 8 support - create generic image for ui e2e tests
- DEF-12396 CentOS 8/CLOS 8/RHEL 8 support - create generic image for ui e2e tests
- DEF-12389 CentOS 8/CLOS 8/RHEL 8 support - create plesk image for ui e2e tests
- DEF-12391 Purge ClamAV
- DEF-12364: Fix modsec rules deploy on correlation-ui
- DEF-12001 Add plugin MrProper and cleaners
- DEF-12050: Notify agent that new autorules.yaml is ready
- DEF-12373: PHP-daemon: error #503
- DEF-12327: Fix bug in connection DEF-12327: Fix invalid fingerprinting
- DEF-11195: Add black formatting for all subprojects
- DEF-11195: src/mrs-services reformat
- DEF-11195: src/integration-tests reformat
- DEF-11195: src/git-doc reformat
- DEF-11195: src/files reformat
- DEF-11195: src/events reformat
- DEF-12152 fix some texts
- DEF-12152 restore-from-backup request should not block UI - UI part
- DEF-11112 Update provision for Centos/CL8 generic panel
- DEF-12210 Ensure fail2ban is running if enabled
- DEF-12283 CentOS 8/CLOS 8/RHEL 8 support - create centos8-directadmin image for ui e2e tests
- DEF-11397: Add files.imunify360.com to monitoring
- DEF-12299 Rework "Wordpress Account Compromise Alert" page
- DEF-11718 Bypass scan by trailing space in file name
- DEF-11882 test_socket_activation.test_socket_activation_long_action failed
- DEF-11111 Update provision for Centos/CL 8
- DEF-11556: Check system_id query parameter in auth
- DEF-9279 Remove Acronis agent if it was installed by us. Do not ask in i360deploy.sh
- DEF-12327: Fix bug in connection
- DEF-11556: system_id sync
- DEF-12345: Write errors in parsing msg to warning
- DEF-12124: Document deploy process for xray.js file
- DEF-12011 client wants to use language that is different from the Plesk default language
- DEF-12345: Write errors in parsing msg to warning
- DEF-12129: add RPM tests to cover new imunify-realtime-av spec
- DEF-7042 Hash in the DB does not match real file hash
- DEF-12251: Send MongoDB collections sizes to monitoring
- DEF-11556: Create temporary mock
- DEF-11897: Deploy and check correlation-ui
- DEF-12302 Fix retries in tests - zone.js do not seem to work in node
- DEF-11731: Remove file from malware_standalone.list
- DEF-12021: Impelement new end-point and new tables for saving of statistics about clients rpm packages
- DEF-12151 restore-from-backup request should not block UI - agent part
- DEF-12043 Set scan-depth=2 for app version detector
- DEF-12034 fix switching ossec config on pam settings change
- DEF-12276 Fix realtime scanner RPM tests
- DEF-11840 Use new cloud for test images
- DEF-11923 total_files always 0 from malware on-demand list output
- DEF-11755 Bulk actions to blacklist/whitelist IPs - implement
- DEF-11701: Setup monitoring to jenkins worker nodes
- DEF-11329: Run correlation API with 4 workers
- DEF-12239: Fix haproxy 502 errors
- DEF-11110 CentOS 8/CLOS 8/RHEL 8 support - create image for ui e2e tests
- DEF-12236 Link to settings from restore-from-quarantine modal do not remove modal backdrop in plesk
- DEF-11840 Use nebula credentials from jenkins
- DEF-11878 Allow to run e2e tests on dev-server
- Revert "DEF-11510 Disable test_web_scanner in container"
- DEF-11650 Typo in the UI PLESK in Imunify360 extension
- DEF-12240: Return user scan endpoints
- DEF-12138 Handle non-unicode symbols in ai-bolit output
- DEF-12132 Typo in "WordPress Account Compomise"
- DEF-12153: Cache the results of restore-from-backup
- DEF-11812: Replace "--skip-root-owner" with "--skip-system-owner" ai-bolit paramter in the agent
- DEF-11108 Add ability to build imunify package on Centos/CL 8
- DEF-11290 Add default_action to MalwareScan report
- DEF-11289 Add AI-BOLIT args to MalwareScan report
- DEF-11291 Add procu2 args to MalwareCleanup report
- DEF-11106 CentOS 8/CLOS 8/RHEL 8 support - deployscripts


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.9.2-2
changelog:
- Bump ai-bolit version to 20.0619-1
- DEF-12636 [AI-BOLIT] deobfuscator can't deobfuscate the sample 1848f147c179962d9626b8934f7d7503c74722adcaac4543eee952a406285390
- DEF-12663 [AI-BOLIT] deobfuscator can't deobfuscate the sample 9575b0ddf36a146bec7d1e910f4aad05c61493df82eb0c3ef0bc17740516dfde
- DEF-12716 [AI-BOLIT] deobfuscator can't deobfuscate the sample f4d3270906909dcf30c0f2394c8500bb654eca56918dbe8140d2a3223287f8de
- DEF-12718 [AI-BOLIT] deobfuscator can't deobfuscate the sample 8ba86b71b3f3a66530fa8f99e9f27b872eb6377e27600bc4e183a03e2f9e6376
- DEF-12749 [AI-BOLIT] Signature is hanging the cleanup
- DEF-12767 IntegrityError: FOREIGN KEY constraint failed
- DEF-12772 [AI-BOLIT] Change Priority Of Cloud Assisted scan for whitelist to have higher priority over blacklist
- DEF-12822 [Suggestion] Ignoring maildir path


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.9.6-8
changelog:
- Change ai-bolit version to 20.0717-1
- DEF-13193 'on-demand queue remove' doesnt kill ai-bolit process


author: Pavel Zaikin <pzaikin@cloudlinux.com> 5.2.0-2
changelog:
- DEF-13811 Restored from backup files still marked as infected
- DEF-13725 Preview files from quarantine leads FileNotFoundError
- DEF-13689 Malware ignore list is not escaped when compiled into the common exclude list


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.2.1-1
changelog:
- DEF-13922 malware-scanning/started hook missing intensity data
- DEF-13908 Strange ImunifyAV scan behavior


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.4.6-1
changelog:
- DEF-13704 Error: Incorrect padding
- DEF-14594 ScanFailed.command should be a list of strings
- DEF-14690 pytest is killed repeatedly by OOM killer on Ubuntu 1GB
- DEF-14777 test_ondemand_queue tests fail
- DEF-14853 Creating /var/log/.log after the installation


author: Pavel Zaikin <pzaikin@cloudlinux.com> 5.6.0-2
changelog:
- DEF-15778 (fix) don't use os.sync without a good reason
- DEF-12933_change_accessibility_to_alt-php74-imunify_interpreter-5.6
- DEF-15797 Move 'malware rebuild patterns' CLI schema to ImunifyAV
- DEF-15774 Added AlmaLinux support
- DEF-15671 `malware user scan` hangs if there are a lot of queued scans
- DEF-14271 Use --username key for procu2 instead of privileges dropping


author: Alexander Tishyn <atishin@cloudlinux.com> 7.6.4-1
changelog:
- DEF-24401 Fix scan queue stuck on avd/mds has been oom-killed
- DEF-25301 Manual cleanup should bypass cleanup attempts limit/Error reporting improvements
- DEF-27076 fix: Return the previous behaviour to save realtime scan hits


author: Dmitriy Leonov <dmleonov@cloudlinux.com> 8.8.1-1
changelog:
- Generate av-internal-optimized.txt alongside the legacy av-internal.txt so
  modern scanners (im-rt2, rustbolit, rustcurator) can consume a trimmed
  exclude list while the legacy realtime scanner keeps using the original
  one. Additive and backward-compatible: the new file is identical to the
  legacy file in this release and will be trimmed incrementally in follow-up
  work. (DEF-41537, DEF-41538)
- Remove remaining 'no detects' patterns from the internal realtime-av
  exclude list so files previously skipped are now scanned. (DEF-40262)
- Only write merged.config defaults when the file is missing, so post-install
  no longer overwrites admin-modified configuration. (DEF-41209)


author: Dmitry Baynak <dbaynak@cloudlinux.com> - 2.1.0-1
changelog:
- DEF-20444 RocksDB: fix write buffer size
- DEF-20328 perform path.Clean on absolute paths in auditd messages


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 2.9.4-1
changelog:
- DEF-32609: bump go version to 1.24
- DEF-33474: read complete log lines before parsing (and drop CL6 support)
- DEF-34634: validate incoming events against basedirs instead of key
- DEF-34711: use general Imunify approach to set sentry tags


author: Arsenii Pastushenko <apasutshenko@cloudlinux.com> - 2.9.5-1
changelog:
- DEF-35454: Throttle events processing to avoid extremely high performance overhead
- DEF-36047: Do not log validate errors
- DEF-36046: correctly manage auditd configuration file
- DEF-36062: fix out of range panic in formEvent
- DEF-36036: correctly handle stale PID file on startup


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.9.9-1
changelog:
- DEF-37213: add write-only fallback for foreign auditd keys while keeping key-based fast path
- DEF-37535: make configuration management static and correctly handle proc discovery error
- DEF-37536: correctly install mysql rule; do not report no such file error for uapi rule
- DEF-36698: enable fgw for auditd and realtime-av
- DEF-38821: Gracefully handle non-existent paths, unknown users, and malformed rules in auditd rules


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.10.0-1
changelog:
- DEF-40037: Add CPUQuota=50% to systemd unit to cap CPU usage on high-volume servers
- DEF-40037: Bound BFS traversal in event storage to prevent unbounded lock hold times
- DEF-40037: Move RocksDB compaction outside the storage lock to reduce contention
- DEF-40037: Buffer event pipeline channels and add drop-on-full backpressure
- DEF-40037: Fix adaptive rate limiter warmup (15 min instead of 90 min, lower initial cap)
- DEF-40037: Yield periodically in ClearOutdated to reduce mergeBuffer contention


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.2.0-1
changelog:
- DEF-20330: extend auditd stats with the scanner type upon malware detection
- DEF-21781: Do not keep i360db open while idle
- DEF-22298 constantly watch for auditd service state and rule presence


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.3.0-1
changelog:
- DEF-23356 ignore write events to error_log
- DEF-23377 reduce allocations by limiting paths count and removing strings.Trim


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.3.1-1
changelog:
- DEF-23606 correctly check if key starts at the end of line
- DEF-23607 do not remove rules when the file is deleted (it is done by auditd automatically)


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.4.0-1
changelog:
- DEF-23637 report exact reason why log reader is not running
- DEF-23866 add more sanity checks and additional stats on message parsing
- DEF-23673 collect and send statistics on top noisy files that caused auditd events


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.5.0-1
changelog:
- DEF-24295 Implement `filters` section so it is possible to filter events on path before storing them
- DEF-24297 Support I360 agent configuration reload
- DEF-24298 Develop a first set of filters for auditd-log-reader
- DEF-24304 Move trace logging of auditd-log-reader out of syslog to file


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.6.0-1
changelog:
- DEF-25106 send limited amount of events per hour (default for 500)
- DEF-21829 remove obsolete stats fields
- DEF-25120 improve config file  structure, auditd statistics collection and exclude more files


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.7.2-1
changelog:
- DEF-25263 make send limit configurable
- DEF-25280 support enriched auditd log format
- DEF-25299 drop wordpress temp write test files


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.7.0-1
changelog:
- DEF-26401 Store cron events for 1 day
- DEF-26592 Report statistics when there are no auditd events for detected malware


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.7.1-1
changelog:
- DEF-26869 Do not search for audit events when no malware found
- DEF-26867 Keep up to 6 paths for audit events
- DEF-26868: report failed to parse lines to Sentry. Limit error count in /var/log/messages


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.7.2-1
changelog:
- DEF-27695 Fix crond events detection during filtering
- DEF-27707 Track noisy files only when gathering top paths statistics


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 2.8.1-1
changelog:
- DEF-27924: Correctly track statistics on sent messages and db rows
- DEF-26875: Do not drop wp-cache events
- DEF-28023: auditd-log-reader unit is now managed by i360-agent


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> - 2.8.3-1
changelog:
- DEF-30200: add ability to set auditdctl custom fields to ignore mariadb/mysql generated events
- DEF-30201: add public_html/wp-content/debug.log to auditd_exclude


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> - 2.9.0-1
changelog:
- DEF-29441: add monitoring rules, add filters to send /etc/valiases/, /etc/vfilters, /etc/vdomainaliases paths to corrAPI
- DEF-28525: add imunify-auditd-log-reader support for Debian and Ubuntu OSes
- DEF-28084: store and send all events associated with /usr/local/cpanel/uapi


author: Aleksandr Vorobev <avorobev@cloudlinux.com> - 1.2.0-1
changelog:
- Forbidden run without --key arg
- Switch to the new imunify360 config path
- Use commit hash in gerrit builds
- Update license
- Add README.md


author: Amit Levy <alevy@cloudlinux.com> - 1.3.7-2
changelog:
- DEF-35549: Remove GetIgnoredPaths RPC
- DEF-35523: use grpc stream for ignore list
- DEF-35345 Add cli interface for grpc-client
- DEF-35345 Add generic grpc client
- DEF-35257 Add gRPC client for proactive ignore lists
- DEF-35109 Read proactive whitelist data from redis datastorage on update


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 1.3.8-1
changelog:
- DEF-35203: Make naming consistent and get rid of wrong repeated field
- DEF-35281: Pick users from running Kubernetes pods and use application_id as username
- DEF-35203: Edit proactive proto


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 1.3.12-1
changelog:
- (syncer - aibolit) DEF-38792: Translate on-demand scan paths to kubelet mount paths
- (syncer - proactive_ignore) DEF-38792: Fix gRPC error handling with exponential backoff
- (syncer) DEF-38792: Fix lock leak in kubernetes users tracker
- (syncer - aibolit) DEF-38792: Handle unavailable gRPC transport during scan result reporting
- (syncer - aibolit) DEF-38792: Provide generic socket for aibolit in detached mode
- (syncer - aibolit) DEF-38368: Scan realtime requests and report results back to resident-agent
- (syncer - aibolit) DEF-37928: Add scanner registration and on-demand scans execution
- (syncer - aibolit) DEF-37931: Add local aibolit plugin
- (syncer - aibolit) DEF-36986: Add paths translator
- (syncer - proactive_files) DEF-36251: Optimize rsync calls in k8s-syncer to prevent double execution
- (syncer) DEF-37966: Use common sentry logger in im360-k8s-syncer


author: Amit Levy <alevy@cloudlinux.com> - 1.3.12-3
changelog:
- DEF-37986: remove proxy service from common package
- DEF-39031: register active applications in resident-agent
- DEF-39097: Fix uint64 underflow in FGW concurrent queue metrics
- DEF-39030: add RAS where applicable; refactor scan_info.json processing
- DEF-38802: add storage plugin
- DEF-38802: handle malware scan cancellation; handle multiple scans
- DEF-38802: Handle cleanup requests by syncer and move storage operations into custom plugin
- DEF-38836: Add realtime_proxy plugin for job files reporting


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> - 1.3.2-2
changelog:
- DEF-32946: Use dedicated functions for io operations; use delimiters for detecting garbage data
- DEF-32946: rework fgw tests
- DEF-32924 Fix incorrect file management by FGW cli


author: Danil Khabibullin <dkhabibullin@cloudlinux.com> - 1.3.4-8
changelog:
- DEF-34419 Make rotatable JWT secret for proxy API
- Fix uninstall process
- DEF-31596 Add proxy server for rpc commands


author: Timur Irmatov <tirmatov@cloudlinux.com> - 1.0.2-1
changelog:
- do not fail in the absence of a config file
- fix first trigger period
- implement pd_blocked_script integration test
- Deliver event_id to custom script target
- Update localization behaviour: search closest locale
- Enable reporting based on agent config
- Remove Jenkinsfile due to moving to unified unit tests job
- Implement email delivery integration test.
- Fix reading notify_from_email; update sendMailConsole
- create integration tests for time triggerable events
- create integration tests for manually triggered events
- Update packaging: remove last_trigger.yaml file
- Fix sendmail email sending
- Verbose logging and update sentry error reporting


author: Timur Irmatov <tirmatov@cloudlinux.com> - 1.2.0-4
changelog:
- Add unit test for template overriding
- Add serverName to email subject
- Collect imunify-notifier logs as artifacts
- Update cron job generating
- Add unit test for updateCronJob
- Remove redundant Event interface
- Add unit test for ConfigRulesUpdater
- Increase unit test coverage for extractors
- Add unit test for agent rpc calls
- Automate integration tests with jenkins


author: Timur Irmatov <tirmatov@cloudlinux.com> - 2.0.0-1
changelog:
- Update Go version to 1.16.3
- Switch to the new imunify360 config path
- Malware scan info is not filled at times
- Proactive events extractor can skip events
- Drop old tests, minor cleanups
- Implement realtime scan event
- Implement proactive defense events
- Add new test flow, implement for malware
- Add helper functions
- Proactive events extractor fails to fetch user name
- Fix "scan is already running"
- Adjust extraction to new unified extractor
- Add unified extractor
- Copy extractors' database logic to agent package
- Remove Rule interface


author: Aleksandr Vorobev <avorobev@cloudlinux.com> - 2.1.0-1
changelog:
- Fix CentOS 6 detection
- Fix SIGPIPE handling
- Change sentry DSN
- Silence empty body events
- Use commit hash in gerrit builds


author: Mikhail Faraponov <mfaraponov@cloudlinux.com> - 2.1.6-1
changelog:
- DEF-23058: Reduce number of sqlite accesses to database on empty payload
- DEF-23050: Added graceful extractor sqlite3 connection shutdown


author: Pavel Kuzmuk <pkuzmuk@cloudlinux.com> - 2.1.8-1
changelog:
- Add reading of RealtimeAV config file
- Integrate matching with with GlobTree
- Switch to inotify if fchange api fails
- Extract run-with-intensity


author: Anton Osatiuk <aosatiuk@cloudlinux.com> - 2.2.0-1
changelog:
- Add deletion of old notify jobs through CLI
- Add flock to service startup
- Add cleanup statistics
- Add stats sending to Correlation API
- Add dependencies for /usr/bin/getconf
- Add auxiliary packages
- Extract error handling from watchers
- Extract file change API logic to filechange package
- Extract systemctl calls to service package
- Fix assignment to entry in nil map
- Upgrade dependencies


author: Timur Irmatov <tirmatov@cloudlinux.com> - 2.2.2-1
changelog:
- Update cln-pub.key location
- fix chainNode.patterns bug
- do not fail if at least one unix.FanotifyMark ended with success


author: Timur Irmatov <tirmatov@cloudlinux.com> - 4.1.0-1
changelog:
- Decrease number of events
- Missing av-admin-paths.txt as empty
- Update watcher API fallback policy


author: Timur Irmatov <tirmatov@cloudlinux.com> - 6.0.0-1
changelog:
- Switch to the new imunify360 config path
- Fix silent unit tests failures
- remove cloudlinux-fchange package if 'optimize realtime scan' option becomes disabled
- Fix integration tests and start them during package build
- rewrite selectTargetAPI


author: Timur Irmatov <tirmatov@cloudlinux.com> - 7.0.0-12
changelog:
- fix SIGPIPE handling
- Add flushing and compacting storage on SIGUSR1
- Remove supported marker on uninstall
- Fix agent.UpdateConfig redundant JSON escaping
- Fix audit support checking routine
- Change auditd binary/service names
- Add performance tests
- Use our fork of go-libaudit
- Adjust auditd-log-reader init.d script
- Add init.d script for auditd-log-reader
- Enable building rocksdb statically with auditd-log-reader
- Add ability to provide config via cli arguments
- Fix shutdown-related bug
- Move default correlation API base URL to api package
- Implement main processing routines
- Add proc package
- Remove appFs from realtimeav.ReadConfig arguments
- Add AUDITD_FILES API method
- Add merge operations buffer
- Add event compaction filter
- Add event merge operator
- Add building RocksDB before unit tests
- Add basic event storage logic
- Extract Event structure from main package
- Extract realtime config to realtimeav package
- Add extracting malware files from Imunify360 DB
- Fix warnings shown by go-staticcheck
- Add extracting data from parsed audit event
- Add log parser
- Add tailing auditd log file
- Add main log reader flow
- Add functionality to check service status
- Add functionality for Imunify360 config updates
- Add LOGGER section to agent config
- implement deciding whether feature is supported
- fix reading plugin files
- implement reading auditsp plugin config
- implement reading audispd config
- implement reading auditd config


author: Anton Osatiuk <aosatiuk@cloudlinux.com> - 7.1.0-1
changelog:
- Change sentry DSN
- Update license
- Fix reading absent values in auditd config
- Add sending logs to syslog
- Add fallback parsing of /etc/system-release
- Add creating PID file
- Wait for filechange API to start after installation
- Add README.md
- Fix forming audit event without proctitle


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> - 7.1.4-1
changelog:
- DEF-17530 adjust log reader goroutine flow
- DEF-17483 close stdout when there's no need to read from it anymore
- DEF-17523 Added synchronization for RocksDB wrapper and merge buffer


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> - 7.1.5-1
changelog:
- DEF-17669: adjust merge operator and compaction filter logic to 'survive' through broken data
- DEF-17525: extend Sentry tags
- DEF-17528: silence config load failure when audit package is not installed
- DEF-17528: silence 'key not found' error
- DEF-17492: added cron job with daily cloudlinux-fchange package update
- DEF-17524: introduce an upper limit LOG* files for RocksDB


author: Kondratev Pavel <pkondratyev@cloudlinux.com> - 7.1.7-1
changelog:
- DEF-18431: Add rate limit for sentry (No space left on device)
- DEF-18432: Add rate limit for sentry (auparse key not found)


author: Dmitry Baynak <dbaynak@cloudlinux.com> - 7.2.0-1
changelog:
- DEF-20205: Real-time scanner watchers improvements
- DEF-19802: imunify-realtime-av: implement FC API watcher that directly reads kernel interface


author: Alexander Tishin <atishin@cloudlinux.com> - 7.2.2-1
changelog:
- DEF-22397 Use a separate inotify watcher for /var/spool/cron real-time scanning
- DEF-22871 Fix panic on centos 6 when optimize_realtime_scan set to true
- DEF-23079 Fix 'open /dev/.lxd-mounts: permission denied'


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.2.8-1
changelog:
- DEF-36698: enable fgw for auditd and realtime-av
- DEF-29554: Realtime AV race condition with crontab


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.2.9-1
changelog:
- DEF-38836: report root owner events (containerised environments)
- DEF-38836: switch to Unix socket for containerized environments
- DEF-38821: handle non-existent paths, unknown users, and malformed auditd rules
- DEF-38417: enable alternatives-based entrypoint for im-rt2 coexistence


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 8.0.0-1
changelog:
- Align realtime-av logging with legacy expectations (trace fallback, SIGHUP reload)
- Report inotify watcher selection in logs for emulation mode
- Fix fanotify mount selection to include root filesystem
- Restore legacy temp-dir prefilter behavior for top-level files
- Centralize legacy temp directory list to avoid drift


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 8.0.1-1
changelog:
- Add Sentry error reporting (shared DSN with legacy realtime-av)
- Panic recovery with Sentry capture in all goroutine workers
- Load sentry tags from /var/imunify360/.sentry_tags


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 8.0.2-1
changelog:
- Add leveled logging (Trace/Debug/Info/Error/Fatal) with full legacy parity
- Add SentryWrapper: all log output becomes Sentry breadcrumbs
- Rate-limited error reporting for hot-path errors (fanotify, eBPF, aibolit, stats)
- Deferred Sentry capture in ErrorfWithLimiter to avoid 3s flush on suppressed errors
- Reset log level to Info on SIGHUP when leaving trace mode
- Increase unit test coverage to 85% with CI enforcement
- Generate coverage reports before threshold check for CI artifact availability


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 8.0.3-1
changelog:
- Fix shutdown race: wait for readEvents goroutine before closing fanotify FD (Sentry K92)
- Suppress Sentry reports for transient aibolit socket errors (Sentry K93/K94)
- Add FAN_ONDIR to fanotify event mask for directory move detection (DEF-39419)
- Treat EBADF as clean shutdown signal in fanotify readers


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 8.0.4-1
changelog:
- Disable FID mode on kernels affected by CVE-2024-47660 (DEF-40056)
- Per-application malware ignore lists for K8s mode (DEF-39163)
- APPLICATION_ID validation at daemon startup
- Fail-fast error handling for av-admin-paths.txt


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 8.0.5-1
changelog:
- Namespace-aware fanotify marking for kernel < 4.20: mark foreign mount
  namespaces (e.g. PHP-FPM PrivateTmp) via /proc/<pid>/root so events
  are visible; periodic refresh for new namespaces (DEF-40136)
- Async eBPF initialization: load BPF verifier in background to avoid
  blocking service startup on older kernels (DEF-40136)
- Auto-enable eBPF when CVE-2024-47660 disables FID mode (DEF-40136)
- FD-based rename detection fallback for degraded mode (no FID, no eBPF)
- Fix crontab realtime scan: detect temp file renames via FD re-resolution
- Adaptive poll/heartbeat tuning on kernel 3.x (fanotify poll bug workaround)
- Non-blocking read on poll timeout for kernel 3.x (ppoll POLLIN starvation fix)
- Move heartbeat file to /var/imunify360/ (marked real filesystem vs tmpfs)
- Fix data race on hasRenameDetection: use derived method instead of field
- Fix interface-nil wrapping in ebpfNewRenameMonitor


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 8.0.6-1
changelog:
- Fix ignored paths to match subdirectories (prefix match) (DEF-40761)
- Add reload cooldown to prevent double restart from concurrent config
  watchers (DEF-40762)
- Auto-disable eBPF tracepoints when perf buffer overflow rate is too
  high on loaded servers with kernel < 5.1 (DEF-40775)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 8.0.7-1
changelog:
- Kernel-space UID filtering for eBPF rename tracepoints: drop events
  from system UIDs (mysql, apache, etc.) before expensive path reads.
  Auto-detects UID_MIN from /etc/login.defs (DEF-40972)
- Per-CPU rate limiting for eBPF events with configurable
  events/sec cap (DEF-40972)
- Early fanotify UID filtering with PID-to-UID cache to skip
  events from system services before path resolution (DEF-40972)
- Adaptive FAN_MARK_IGNORE: auto-promotes hot paths from UID-filtered
  services to kernel-level ignore marks on kernel 6.0+ (DEF-40975)
- Migrate imunify-common dependency from Gerrit to GitLab
- Remove eBPF overflow watchdog (superseded by UID filter + rate limiter)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 8.0.8-1
changelog:
- Drop FAN_MODIFY from fanotify event mask on kernels without
  FAN_MARK_IGNORE (< 6.0) to eliminate kernel-side overhead during
  database write bursts. Relies on FAN_CLOSE_WRITE only. (DEF-41007)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 8.0.9-1
changelog:
- Restart imunify-realtime-av.service on package upgrade so the new binary
  takes effect without requiring a reboot. Previously the package was upgraded
  on disk but the running process kept executing the old binary from its
  in-memory inode, causing ~159k servers to appear stuck on older versions
  in telemetry. (DEF-41800)
- Use SHA-256 content hash (not mtime) to detect real scanner config changes.
  The agent's atomic rename in generate_configs() refreshes mtime on every
  run; the old fingerprint treated this as a config change and reloaded every
  ~10 minutes for no reason. Two-phase check keeps the cheap mtime fast-path
  and only reads file contents when mtime actually moves. (DEF-41662)
- Add Sentry reporting and panic recovery for scanner fallback paths. Fatal
  exits (including the pre-exec "falling back to legacy" path that previously
  died silently), missing legacy binary and failed syscall.Exec are now
  captured with sync flush. A fallback marker file
  (/var/imunify360/imrt2-fallback-reason) is written before exec and cleared
  on successful startup so external tooling can detect fallback state. All
  long-running goroutines now recover panics via sentry.CapturePanic.
  (DEF-41428)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 8.0.10-1
changelog:
- Invert shutdown order so kernel hooks (fanotify FD, eBPF perf reader,
  tracepoint links) are detached BEFORE in-memory queues are drained.
  Under sustained event pressure the previous ordering deadlocked: a
  downstream blockage kept readEvents wedged on a channel send, the
  WaitGroup never returned, and the kernel kept pumping events into
  the fanotify queue and eBPF perf rings. systemd then SIGKILL'd, but
  the kernel could not reap threads still holding attached objects, so
  processes lingered minutes in D-state. Production evidence:
  chi206.greengeeks.net (4 min 31 s SIGTERM-to-reap, 2026-04-21) and
  in-mum-web1119.main-hosting.eu / Hostinger (4 min 57 s, 2026-04-27).
  An 8 s shutdown watchdog calls os.Exit(0) cleanly if any stage
  exceeds budget, so systemd never escalates to SIGKILL. (DEF-42248)
- Respect explicit -enable-ebpf=false on kernels affected by
  CVE-2024-47660 (Ubuntu 24.04 6.8.x, AlmaLinux 9 pre-5.14.0-570.el9_6,
  Debian 12 pre-6.11). The previous code silently re-enabled eBPF in
  this scenario, defeating the operator's documented mitigation for
  the high-CPU eBPF tracepoint path. The scanner now falls back to
  FD-based re-resolution for rename detection (FAN_CLOSE_WRITE
  scanning is unaffected). (DEF-42082)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 8.0.11-1
changelog:
- Recognise cronie's "#tmp.<host>.XXXXXX" atomic-write filename in the
  temp-file rename heuristic, so the post-rename
  /var/spool/cron/<user> path reaches userspace on kernels that lack
  both fanotify FID mode and eBPF rename tracepoints (DEF-42417).
- Add per-stage timing logs to Monitor.Stop() so each shutdown step's
  elapsed wall time is recorded on every clean stop
  (detachKernelSubscriptions split per-substep, the WaitGroup waits,
  ebpfMonitor.Stop, dirScan/coalescer/stats/filter, aibolitWriter.Stop,
  total). On the shutdown-watchdog timeout path (Stop() exceeded its
  budget), capture a goroutine-stack snapshot in-memory and persist
  it to /var/imunify360/imrt2-watchdog.log via raw os.OpenFile + Write
  with O_NOFOLLOW (mode 0640) BEFORE any blocking I/O, so the
  diagnostic survives even when the journal is unresponsive — the
  failure mode that left the previous DEF-42248 stuck-shutdown
  incident un-explainable. The dump also ships to Sentry as event
  extra (truncated to 100 KB) for fleet-wide queries; the local file
  has the full text. A logrotate config at
  /etc/logrotate.d/imunify-realtime-av-imrt2 caps growth across
  repeated wedges. (DEF-43240)
- Add kernel_ring_lost field to the stats.log JSON, accumulating the
  count of events the kernel dropped from the eBPF perf event ring
  because the userspace reader could not drain fast enough. Distinct
  from the existing overflow_events counter (fanotify FAN_Q_OVERFLOW).
  Operators can now graph kernel-side event drops from stats.log via
  Redash without grepping the journal for "Lost N eBPF events"
  warnings. (DEF-43241)
- Reduce log volume from the dirfd-resolution warning ("Could not
  resolve dirfd … falling back to CWD"). The per-event line moves
  to Trace level (off in production); the cleanupCwdCache 30 s ticker
  drains an atomic counter and emits a single aggregate Info line per
  window when the count is non-zero. Customer reports of tens of
  thousands of these lines per /var/log/messages rotation cycle drop
  to one line per 30 s. Operators still see rate spikes if the
  fallback rate climbs. (DEF-43241)
- Drop the 7 s SIGTERM startup grace window. The grace dropped SIGTERM
  via "continue" without latching it for replay. Under systemd-driven
  stops the daemon then sat in stop-sigterm until TimeoutStopSec=30 s
  elapsed and was SIGKILL'd, losing the in-flight aibolit writer queue
  and triggering the rpm-test cascade where ai-bolit 32.8.3's %pre
  systemctl-stop of aibolit-resident landed inside the freshly
  restarted im-rt2's grace window. SIGTERM is now always honored
  immediately; the 8 s shutdown watchdog (DEF-42248) covers clean
  fast-shutdown. (DEF-43323)
- Clear the /var/imunify360/imrt2-fallback-reason marker only after a
  successful monitor start, not unconditionally at process entry. The
  marker now reflects the last startup outcome (present = last attempt
  fell back to legacy; cleared = demonstrated successful start since
  the last fallback) instead of being transiently erased on every
  systemd restart. (DEF-43338)
- Bugfixes.


changelog: - Internal release of nginx-based captcha server (for integration tests)
author:
Igor Savenko <bliss@cloudlinux.com>, Alexander Tishin <atishin@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 0.9-1


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> - 0.9-4
changelog:
- DEF-3165 Do not start Nginx captcha by default
- Minor bugfix: Google Chrome does not refreshes page after captcha has been passed


author:
Igor Savenko <bliss@cloudlinux.com>, Alexander Tishin <atishin@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 0.9-5

changelog:
- DEF-3428 Fix invisible captcha
- DEF-3165 Do not start Nginx captcha by default
- Minor bugfix: Google Chrome does not refreshes page after captcha has been passed


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> - 1.0-6
changelog:
- DEF-3169 Migrate user captcha customization to Nginx
- DEF-3331 Mark nginx access log with XFF field
- DEF-3428 Fix invisible captcha in Nginx
- DEF-3507 imunify360-captchaserver-nginx rpm has to be removed on imunify360 uninstall
- DEF-3567 Bump server_names_hash_bucket_size fix


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> - 1.0-7
changelog:
- DEF-3169 Migrate user captcha customization to Nginx
- DEF-3331 Mark nginx access log with XFF field
- DEF-3507 imunify360-captchaserver-nginx rpm has to be removed on imunify360 uninstall
- DEF-3567 Bump server_names_hash_bucket_size fix


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> - 1.0-8
changelog:
- DEF-3331 Mark nginx access log with XFF field
- DEF-3507 imunify360-captchaserver-nginx rpm has to be removed on imunify360 uninstall
- DEF-3567 Bump server_names_hash_bucket_size fix


author: Oleksiy Shchukin <oshchukin@cloudlinux.com>, Nikolay Telepenin <ntelepenin@cloudlinux.com> 1.0-9
changelog:
- DEF-3277 Do not create imunify360-captcha user
- DEF-3517 Added X-Requested-With header to nginx log
- DEF-3331 Mark nginx access log with XFF field
- DEF-3507 imunify360-captchaserver-nginx rpm has to be removed on imunify360 uninstall
- DEF-3567 Bump server_names_hash_bucket_size fix


author: Nikolay Telepenin <ntelepenin@cloudlinux.com> - 1.1-2
changelog:
- DEF-3507 Remove nginx captcha along with imunify360
- DEF-3497 Rebuild localization templates before start
- DEF-3428 Fix invisible captcha in Nginx
- DEF-3637 Fixing logrotate error
- DEF-3614 Filter whitelisted domains requests for DOS detect


author: Nikolay Telepenin <ntelepenin@cloudlinux.com> 1.1-3
changelog:
- DEF-3507 Remove nginx captcha along with imunify360
- DEF-3497 Rebuild localization templates before start
- DEF-3428 Fix invisible captcha in Nginx
- DEF-3637 Fixing logrotate error
- DEF-3614 Filter whitelisted domains requests for DOS detect
- DEF-3739 Fixup "update results in 'imunify360-captchaserver-nginx dead but pid file exists'"


changelog: - Internal release of nginx-based captcha server (for integration tests)
author:
Igor Savenko <bliss@cloudlinux.com>, Alexander Tishin <atishin@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 0.9-2


author: Timur Irmatov <tirmatov@cloudlinux.com> 4.0.0-2
changelog:
- DEF-6224 Memory and CPU usage / footprints while scanning malware in Imunify A/V
- DEF-7317 Raise nodejs version in rpm/deb specs (build dependencies)
- DEF-7519 Handle certificates per IP correctly (give away certificate that belongs to this IP)
- DEF-7533 Create screenshots for 100 server_ids (real) for dashboard
- DEF-6059 Make webshield/wsshdict load tests
- DEF-6696 Fix randomly failing nightly e2e tests on master
- DEF-3287 Make sure /etc/sysconfig/kcare/systemid is correct
- DEF-5514 New Dashboard - UI - Chart
- DEF-6160 Expander with hideOnLoad=false should stay open for the same items
- DEF-6428 Use i360deploy.sh to (un)install Imunify360 when (un)installation is done via the Plesk extension
- DEF-6478 Refresh separate lines in tables instead of pages
- DEF-6572 Don't quaranteen files owned by system users
- DEF-6706 Upgrade Angular Material to >=6.4.2 to fix accessibility issues with form components
- DEF-6710 Settings fields and other inputs should all have a label
- DEF-6756 Do not ignore incidents from whitelisted IPs
- DEF-6774 Fix/improve English version of i18n file and update others
- DEF-6858 Blamer v0.1
- DEF-6876 Add ability to enable and disable blamer on UID level
- DEF-6877 Create whitelist testing for blamer
- DEF-6882 Add ability to enable and disable blamer on UID level - UI
- DEF-6883 Add ability to enable and disable blamer on UID level - Agent
- DEF-6884 Add a button to enable / disable blamer in proactive defense - UI
- DEF-6885 Add ability to enable/disable blamer in proactive defense on global level
- DEF-6886 End-user configuration should be sent in SERVER_CONFIG message
- DEF-6890 Improve messages related to Imunify360 products family on CL OS
- DEF-6904 Outdated webshield self-signed SSL certificate
- DEF-6909 Make load/functional tests for Webshield SSL functionality
- DEF-6927 Use angular material overlay for news component in navigation
- DEF-6964 Move blamer option to the imunify.config
- DEF-7043 Fix labels in Proactive Defense mode radio group
- DEF-7074 Update to angular 7
- DEF-7082 Push WebShield version in sentry reports
- DEF-7093 Do not quarantine mail
- DEF-7157 Features management - hide switchers for users with packages
- DEF-7160 Add ability to re-run behave tests without re-creating cPanel user each time
- DEF-7193 Run unit tests at a RPM/DEB package build time
- DEF-7200 Update agent to work correctly with ossec 3.1.0-3
- DEF-7206 Make sure that same messages from different servers from sentry would be recorded in the same place
- DEF-7271 Create cPanel extension for Feature management
- DEF-7273 Add ability to check if cPanel version is correct/supported, don't support for version prior to 68
- DEF-7274 Add CLI to disable native feature management
- DEF-7276 initiate native feature management on user request
- DEF-7277 Run disable feature management to uninstall package extension on package uninstall
- DEF-7278 Automatically add IM360 extension to all new cPanel packages
- DEF-7279 PERL: Implement cPanel hook to send imunify360 settings from package/account to IM360
- DEF-7280 Add event processing for events from cPanel hooks
- DEF-7281 Support to multiple values for antivirus in features management
- DEF-7282 modify end user UI for malware scanning
- DEF-7283 if native feature management supported -- don't show default settings in proactive defence for admin
- DEF-7284 Modify Settings->Feature Management page when native feature management is supported
- DEF-7320 Cover imunify360-firewall and imunify-antivirus packages conflicts with tests
- DEF-7327 Split shared memory daemon to master and worker
- DEF-7330 New Dashboard - UI - Map
- DEF-7331 Sentry - move to a separate project
- DEF-7332 Make separate sentry project for webshield
- DEF-7337 Research angular unit tests
- DEF-7342 Features management - rename cleanup to antivirus and add 3-states switcher for it
- DEF-7343 New Dashboard - UI - add date range and data source filter
- DEF-7344 New Dashboard - UI - connect to backend
- DEF-7349 disable IM360 UI for end user if all the feature management options are disabled
- DEF-7436 Create schema for new commands
- DEF-7437 Disable internal feature-management when native one is enabled
- DEF-7469 HackerTrap access to malware found lists
- DEF-7487 New Dashboard - UI - Changes according to new design
- DEF-7489 Remove submit of FP/FN via email
- DEF-7515 New Dashboard - UI - change tooltip styles according to design
- DEF-7525 Webshield: exclude ports for missing services
- DEF-7534 Reserved space for changes for New feature management UI
- DEF-7535 New Dashboard - UI - connect to backend - fix panel-related issues
- DEF-7560 On cPanel account removal, remove user from imunify360 database
- DEF-7563 add rpm tests for handling cPanel events
- DEF-7604 Send first PING message right away after connection to server is made
- DEF-7184 Make unit tests work on MacOS X
- DEF-7319 Enable end-user UI for "webmaster" role in Plesk
- DEF-5523 Malware Scanner newline character bypass
- DEF-6952 Remove ossec service handling from imunify-antivirus init script
- DEF-7035 Fix language detection (detect dialects correctly)
- DEF-6908 MALWARE_CLEANUP section not present in config show, so ui is broken for av/av+
- DEF-6961 Imunify360 plugin in DirectAdmin is stuck (100% CPU)
- DEF-6963 CloudLinux is incorrectly detected when selecting HardenedPHP implementation
- DEF-6996 Fix issue with IP input in Safari
- DEF-7153 Fix "can not find translation key" errors
- DEF-7167 Investigate why upgrade of imunify360-firewall-cpanel doesn't always work correctly
- DEF-7314 Fix failing tests due to news component
- DEF-7315 Fix slack reporter for tests
- DEF-7409 Investigate and fix route guards
- DEF-7433 non-root "config show" should return root's value if user hasn't changed it yet
- DEF-6117 GeoIP data is incorrectly imported sometimes
- DEF-6358 Fix minor styles issue on the Scan page
- DEF-6691 Fix datepicker css in some languages
- DEF-6504 test_remoteip failure
- DEF-6936 Create script for jenkins that would measure resource usage and report it in jenkins
- DEF-6967 User creation can fail on Plesk
- DEF-7191 PanelError: Certificate is not ready for panel.site:52223
- DEF-7257 Fix rpm-tests for ImAV (ansible)
- DEF-7311 Stop iptables on CentOS6 task fails
- DEF-7682 Apply default FM config to existing FM users
- DEF-7698 KeyError: 'malicious' in test_malware.test_user_list.test_infected_count
- DEF-7697 remove TestNativeFeatureManagement tests
- DEF-7669 Fixed feature management hook
- DEF-7661 Removed test_cpanel_hooks - not needed


author: Timur Irmatov <tirmatov@cloudlinux.com> 4.0.1-1
changelog:
- DEF-7711 113_move_quarantined_files migration fails with UnicodeDecodeError
- DEF-7230 Do not display 'N still infected'
- DEF-7737 Fix itertools import in utils
- DEF-7711 Fix UnicodeDecodeError during cleanup
- DEF-7741 Migration to fix config
- DEF-7749 Run 113_move_quarantined_files migration only once


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.0.2-4
changelog:
- DEF-7867: leave alt-php71-mbstring package when removing hardenedd-php
- DEF-7791: Use DNAT instead of REDIRECT
- DEF-7762 Fix the use of i360deploy.sh in plesk extension
- DEF-7439 Cover Plesk Marketplace installation/upgrade/removal with rpm tests
- DEF-7790: yum remove imunify360-firewall does not remove ossec-hids fix requires for imunify360-ossec-server and psmisc
- DEF-7714: use alt-sqlite instead of system sqlite
- DEF-7106 Use IPvXNetwork instead of str
- [DEF-7703] Add system folders/files of ImunifyAV for Plesk into ignore list of Imunify360
- [DEF-7595] Failed test: test_malware_scanner.test_pure_ftp_scanner
- DEF-7826 AI-BOLIT should use mbstring PHP module
- DEF-7739 Files still ignored on reinfection and supported issues
- DEF-7660 fix KeyError: '_PACKAGE_EXTENSIONS' in rpm test


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.0.5-1
changelog:
- DEF-7968: fixed cache for CSF allow/ignore lists
- DEF-7973: Fixed edit with zero expiration
- DEF-7978: Fixed TypeError in WhitelistClientUnblock
- DEF-7981 fix "unable to modify TTL and comment"


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.0.6-2
changelog:
- DEF-8007 remove check_users from imav_deploy.sh
- DEF-7948 Imunify360 Cleanup File - Arbitrary File Overwrite
- DEF-7980 Imunify360 Restore Original File - Arbitrary File Overwrite


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.0.7-1
changelog:
- DEF-8011 Webshield experiences memory leakage (problem with certificates)
- DEF-7953 [AI-Bolit] Do not load i360.so while running AI-BOLIT


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.0.8-2
changelog:
- DEF-7777 Bug report, around 1k emails are marked as infected.
- DEF-8033 Broken dashboard interface on Firefox 56
- DEF-8041 Old links in UI
- DEF-8058 [Errno 24] Too many open files
- DEF-8086 Imunify360 not visible in DA in template Evolutiuon
- DEF-8101 V/v malware ignore delete in Malware scanner
- DEF-8080 ssl-caching daemon crashes when cannot open a certificate
- DEF-8096 Make sure files over 2MB are uploadable via Webshield
- DEF-8110 sentrylogs can use up to 6000 threads and more.
- DEF-8045 Fix upload to MRS


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.1.0-5
changelog:
- DEF-8118 test_service_start_on_ossec_fail.test_ossec_good_stop_start_im360 fails
- DEF-7895 Failed test_modsec_rules_disabling (RPM-tests)
- DEF-8073 test teardown failure for test_migrations.test_noop_migration
- DEF-8158 test_watchdog.test_health_bad fails
- DEF-8165 Increase priorities for CaptchaDosAlert & SynclistResponse messages
- DEF-8159 test_rules_restored.test_existing_chain_on_startup failed
- DEF-7230 The removed threats still are listed
- DEF-7732 i360 already loaded error
- DEF-7777 Bug report, around 1k emails are marked as infected.
- DEF-7781 [IM360] - Cleaning the files in the interface does not work
- DEF-7871 Hide "quarantine" option in "status" filter in Malicious files list in ImunifyAV
- DEF-7991 Imunify errors and fails to start after update
- DEF-8033 Broken dashboard interface on Firefox 56
- DEF-8041 Old links in UI
- DEF-8058 [Errno 24] Too many open files
- DEF-8086 Imunify360 not visible in DA in template Evolutiuon
- DEF-8101 V/v malware ignore delete in Malware scanner
- DEF-5836 ['/usr/sbin/cagefsctl', '--update-etc', 'towthatc'] failed with rc [1]
- DEF-5955 IntegrityError: columns network_address, netmask, version are not unique
- DEF-5990 ValueError: Broken message in ossec json log: {"rule":{"level":3,"group":"dovecot,authentication_success,","c...
- DEF-6166 eula update error: aiohttp error for url https://files.imunify360.com/static/eula/v1/description....
- DEF-6765 Remove _check_modsec from conflicts plugin
- DEF-6957 Reproduce & fix "Installing Imunify360 breaks OWASP configuration"
- DEF-6970 Do not try to add modsec vendor if it already exists in cPanel
- DEF-7085 CheckRunError: Command ipset add i360.ipv4.graylist 78.140.7.239/32 timeout 43199 -exist returned non-zero code 1,
- DEF-7246 Convert e2e tests to the new format: fix "Infected exploits are detected successfully"
- DEF-7363 CheckRunError: Command /usr/sbin/httpd -M returned non-zero code 1,
- DEF-7440 Sometimes agent doesn't stopped properly.
- DEF-7496 Multiple RPM test failures caused by MySQL service down (and WHMAPI failures)
- DEF-7612 JSONDecodeError: Expecting value: line 1 column 1 (char 0)
- DEF-7665 Command `csf --restartall` performs long and sometimes fails
- DEF-7680 Plesk: Imunify360 extension installation issues
- DEF-7681 Message sometimes printed incorrectly in logs
- DEF-7743 Fix instantiate-vm.ts script - it hangs sometimes
- DEF-7753 many pytest tests fail if run after behave tests due to vhost_ready() failure
- DEF-7758 Fix country translation in group delete confirmation dialog in blacklist
- DEF-7773 Fix send-to-slack.sh reporter
- DEF-7778 We shouldn't send an event in Sentry for 401 responses
- DEF-7802 Imunify360 can hang during startup due to csf integration
- DEF-7847 Check and fix/disable failing e2e tests on master
- DEF-7861 WHMAPIException: whmapi getpkginfo command failed: Failed to load package “Cloud I”: No such file or directory
- DEF-7865 Imunify360 can break apache config on Plesk during uninstall
- DEF-7879 IP addresses in ipset and webshield are not in sync
- DEF-7881 Failed test_malware.test_user_list.test_infected (from pytest)
- DEF-7980 Imunify360 Restore Original File - Arbitrary File Overwrite
- DEF-8059 Migration 120_scheduled_scan fails during RPM tests
- DEF-8068 Fix styles for input in dashboard
- DEF-8095 Failed test_noop_migration (RPM-test)
- DEF-8096 Make sure files over 2MB are uploadable via Webshield
- DEF-8142 Quarantine file is partially overwritten on reinfection
- DEF-6567 IM360 Agent Watchdog
- DEF-6896 Create 'light' version of RPM tests to run on every commit
- DEF-7080 Compare implementations for storing IPs, subnets & extra data
- DEF-7431 Do not disable ClamAV scan when hiding its results
- DEF-7526 WCAG - improve tests coverage for A level & add tests for AA
- DEF-7573 Make webshield use new LPC tries functionality
- DEF-7623 Remove remaining CLI calls from tests
- DEF-7633 Open source ImunifyAV UI - EULA should only be a part of AV+?
- DEF-7634 Open source ImunifyAV UI - handle a case when AV+ is registered, but cleanup code is not installed yet
- DEF-7635 Open source ImunifyAV UI - check sources for any information that we might not want to open source
- DEF-7637 Refactor news component for new feature
- DEF-7659 test_malware.test_cleanup.test_keep_in_quarntine[quarantine-quarantined] (from pytest) failed
- DEF-7668 Requesting admin contacts
- DEF-7676 Add explicit dependency on clamav-data
- DEF-7685 Webshield: upstream sent too big header while reading response header from upstream
- DEF-7708 Cleanup after removing malicious field from malware on-demand list
- DEF-7736 Show only latest scan threats in user list
- DEF-7776 Speed up imunify360 installation: optimize getdb import
- DEF-7793 Multi-server dashboard - UI
- DEF-7856 Clean proactive table in DataBase periodically with same rules as incidents
- DEF-7863 Improve license page
- DEF-7880 Add debug info about problems with "Already running instance of agent"
- DEF-7892 Multi-server dashboard - server
- DEF-7893 [Malware Scanner] Background/Scheduled Scanning
- DEF-7897 [Malware Scanner] Background/Scheduled Scanning - UI
- DEF-7909 Obtain admin contact from panel
- DEF-7943 Requesting admin contact - config
- DEF-7948 Imunify360 Cleanup File - Arbitrary File Overwrite
- DEF-7953 [AI-Bolit] Do not load i360.so while running AI-BOLIT
- DEF-8002 Send IP addresses to webshield shared memory as addresses
- DEF-8024 Align dashboard data with the start of the day in client's timezone - UI
- DEF-8032 EULA update
- DEF-8045 Fix upload to MRS


author: Timur Irmatov <tirmatov@cloudlinux.com> 4.1.0-6
changelog:
- DEF-8169 Issue with Imunify360 installation on Ubuntu18 (PLESK)
- DEF-8279 The problem is with the email field validator


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 1.0.3-1
changelog:
- DEF-421 Add CSF exception for agent
- DEF-417 Fix registration key prefix
- DEF-404 CLN regkey prefix issues


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.10.1-1
changelog:
- DEF-13218 RuntimeError: Symlink loop from '/home/imadco1'
- DEF-13236 When PD try to figure out what is php version, and other php parameters need extra check if php return correct strings
- DEF-13247 Add new line to src/asyncclient/other/imunify360.cron.d
- DEF-13248 FileNotFoundError: [Errno 2] No such file or directory: '/var/imunify360/files/php-immunity/v1/description.json'
- DEF-13265 Path should be removed from HackerTrap after successful cleanup
- DEF-13271 Reset HackerTrap on agent restart
- DEF-13328 "app_version_info" table is empty
- DEF-13122 [AI-BOLIT] deobfuscator can't deobfuscate the sample 16af7e9809a2f631f9a1e3b3d7c4a849926bef8e5a4536907f433f9979e0b250
- DEF-13198 Make separate rule for blocking standalone malware
- DEF-13211 [AI-BOLIT] Cleaning breaks the Bitrix site
- DEF-13321 Exclude index.php only for Standalone malware execution (10001 4.9.6 and 11001 4.10.1+)
- DEF-13176 [AI-BOLIT] Imunify 360 - php killed by SIGABRT ()
- DEF-13204 [AI-BOLIT] php killed by SIGABRT
- DEF-13249 Migration 145_move_quarantine failed with FileNotFoundError
- DEF-13266 Can't get attribute 'State' error


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.2.0-2
changelog:
- DEF-8145 Fix test_hooks.test_malware_scanning_finished
- DEF-8145 An error is not logged if the agent is misconfigured
- DEF-8398 Make ClamAV binary configurable
- DEF-8317: Fixed test_csf_integration
- DEF-8605 test_malware.test_user_list.test_scan_status fails
- DEF-8608: skip test on Ubuntu 16.04 1k-users
- DEF-8526 test_malware.test_malware_scanner.test_pure_ftp_scanner fails in RPM tests
- DEF-8604 test_malware.test_quarantine.test_reinfection fails
- DEF-8600 test_malware.test_malware_scanner.test_web_scanner fails
- DEF-8595 "malware malicious restore-from-backup" does not work
- DEF-8607 skip 'agent' event in ImunifyAV
- DEF-7732 i360 already loaded error
- DEF-7872 Hide ImunifyAV item in reseller menu in WHM
- DEF-7876 Proactive defense working? (Failed IPTABLES commands list issue)
- DEF-8156 [Feature Request] Allow admin to disable ignore list at end user level
- DEF-8169 Issue with Imunify360 installation on Ubuntu18 (PLESK)
- DEF-8272 [Feature Request] Disable Contact Support in the config
- DEF-8279 The problem is with the email field validator
- DEF-8281 SSL is not working, issue with Cloudflare FULL Strict cert
- DEF-5736 Feature's status (installing/uninstalling) tracking mechanism is unreliable
- DEF-6605 Deploy-script with --uninstall flag should remove all ImunifyAV/Imunify360 requirements
- DEF-7105 TypeError: a bytes-like object is required, not 'str'
- DEF-7126 WebshieldDictException: send error: [Errno 111] Connection refused
- DEF-7461 New Dashboard - UI - Map - fix truncated pins (near sides of the map)
- DEF-7735 rpm test failure: "database is locked" in on_demand.malware_hashes.Malware hashes applied during on demand scan.Malware hash list command shows added hashes
- DEF-7756 handle response from FeaturesManagementAPI.editUserFeatures
- DEF-7802 Imunify360 can hang during startup due to csf integration
- DEF-7838 Fix regular crashes of Visual Review server on Jenkins node
- DEF-7902 Failed test_configuration_management.test_managing_modsec_directives[SecAuditEngine-Off] (from pytest)
- DEF-7911 Incorrect count in blocked ports?
- DEF-7946 test_webshield fails on ubuntu configurations
- DEF-8013 TypeError: modsec_get_directive() takes 1 positional argument but 2 were given
- DEF-8014 Error: {"reason":"Can not find translation","key":"userside.history.malware.events.submited_for_analysis"}
- DEF-8017 TypeError: read_file() missing 1 required positional argument: 'path'
- DEF-8049 Bug from https://sentry.cloudlinux.com/sentry/imunify360-ui/issues/4729709/?referrer=slack
- DEF-8071 modsec audit log is not parsed properly sometimes
- DEF-8075 test_malware.test_cleanup.test_keep_in_quarntine[quarantine-quarantined] RPM test fails
- DEF-8076 When uninstall agent we do not uninstall vendor and brake apache (cPanel)
- DEF-8092 test_rules_restored.test_existing_chain_on_startup failed
- DEF-8093 Not all files are detected by black hash filter
- DEF-8097 cPanel hooks should be executed sequentially for a given target (user) (test_cpanel_events.test_account_is_modified fails)
- DEF-8099 AttributeError: 'SubprocessError' object has no attribute 'stderr'
- DEF-8111 geodb is updated but the corresponding country ipset is not
- DEF-8163 test_malware.test_user_list.test_infected failed
- DEF-8166 Failed test_modsec_vendor_install.test_correct_vendor_installed_plesk
- DEF-8168 test_malware failed due to missing 'HOME' in env
- DEF-8205 license_type is not available from UI
- DEF-8225 OperationalError: too many SQL variables
- DEF-8228 Quarantined file can't be uploaded to MRS
- DEF-8257 Do not include unit tests into imunify package
- DEF-8296 test_malware_user_list unit tests fail sometimes: "jsonschema.exceptions.ValidationError: 'scan_type' is a required property"
- DEF-8313 When upgrading webshield from 1.6 to 1.7 version on Ubuntu it failed to start
- DEF-8327 CL + cPanel + 1k users: test_cagefs_split_configs: AssertionError
- DEF-8352 KeyError: 'url'
- DEF-8361 RuntimeError: coroutine raised StopIteration
- DEF-8362 cron file should contain PATH or we should use absolute paths (imunify360-watchdog)
- DEF-8392 test_malware failed (rpm-test)
- DEF-8393 Failed whitelisted_ip_after_login.Whitelisting ip after login.ensure that user access to panel is whitelisting ip -- @1.1
- DEF-8419 Fix link in restore from quarantine modal window
- DEF-8427 Fix looped cpanel hooks
- DEF-8428 AttributeError: 'set' object has no attribute 'extend'
- DEF-8462 AttributeError: 'cPanel' object has no attribute 'pure_ftp_conf_cls'
- DEF-8463 Failed test_malware.test_cleanup (RPM tests) (Directadmin)
- DEF-8483 Fix Rpc caller service exec should work even if response is divided into several packets
- DEF-8499 inotify.new_account.Newly created account is automatically added to inotify.Inotify automatically starts watching newly created account
- DEF-8526 test_malware.test_malware_scanner.test_pure_ftp_scanner fails in RPM tests
- DEF-8544 Webshield is not picking up panel certificate for cPanel & LiteSpeed
- DEF-8577 NameError: name 'itertools' is not defined
- DEF-8584 Endpoint not found for RPC method "backup-systems init"
- DEF-8595 "malware malicious restore-from-backup" does not work
- DEF-8600 test_malware.test_malware_scanner.test_web_scanner fails
- DEF-8601 Failure during provisioning on disabling Sentry reporting
- DEF-8602 Failure during provisioning on rebooting server
- DEF-8605 test_malware.test_user_list.test_scan_status fails
- DEF-8607 test_hooks failed on AV
- DEF-8610 inotify.new_account, malware_read rpm-tests failed
- DEF-4905 Improve news component - use RSS to extract news
- DEF-6370 Plesk mod_security settings
- DEF-7301 No running process for ImunifyAV when it is not in use - EL7/systemd
- DEF-7347 Re-work e2e tests as functional/unit & api tests
- DEF-7377 No running process for ImunifyAV when it is not in use - EL6/separate binary
- DEF-7578 Optimize SSL processing
- DEF-7635 Open source ImunifyAV UI - check sources for any information that we might not want to open source
- DEF-7652 Re-work e2e tests as functional/unit & api tests - add validation to agent's responses
- DEF-7667 Re-use a11y tests code for VR tests
- DEF-7702 create a test for ossec
- DEF-7825 Re-work e2e tests as functional/unit & api tests - fix small issues (marked with FIXME)
- DEF-7908 prevent regression in memory consumption for imunify-antivirus
- DEF-7933 Add webshield instance to integration tests
- DEF-7936 Silence warnings about inconsistent firewall rules
- DEF-7963 Set typical values with flags, not string values
- DEF-7964 Add our Jenkins jobs with tests to build.cloudlinux.com to make sure our tests run on every release build
- DEF-8001 user configs stored in /etc/imunify360/user_configs lead to quadratic increase in disk usage with increase in user count
- DEF-8023 Purge Heuristic scan
- DEF-8074 pytest complains about yaml.load() without Loader=...; possible security issue
- DEF-8098 Create multiconfiguration job to test ImunifyAV
- DEF-8102 Add `scan_id` to `malicious list` output
- DEF-8139 ossec active response UI / enable / disable -- backend part
- DEF-8144 Add hook management functionality
- DEF-8145 Plugin to execute hooks
- DEF-8146 Native hooks
- DEF-8179 Dashboard - add recommendations
- DEF-8181 Dashboard - numbers above charts
- DEF-8182 Reputation management - update UI
- DEF-8200 Record the time of last 'full' scan per user
- DEF-8204 update icons and descriptions in Plesk extension
- DEF-8207 Recursive symlink does not break the scanner case fails
- DEF-8209 Split HostingPanel code
- DEF-8210 Remove client360 plugin dependency to (almost) all kind of messages
- DEF-8211 Move CSF integration to corresponding plugins
- DEF-8212 Create separate package for imunify360-only code
- DEF-8213 Move 360 plugins to separate package
- DEF-8214 Move 360 endpoints to separate package
- DEF-8219 Remove ip whitelist middleware
- DEF-8220 Remove KernelCare/HardenedPHP handling from CLN class
- DEF-8230 Dashboard - add malware chart - server
- DEF-8239 Update behave rpm-tests which use unoptimized steps
- DEF-8260 Review and apply new translations
- DEF-8261 Remove client360 plugin dependency on received messages
- DEF-8316 Replace "Lists" in the global menu with "Firewall" item
- DEF-8317 Disable integration with CSF via settings
- DEF-8323 Reputation management - update agent
- DEF-8372 ossec active response UI / enable / disable
- DEF-8395 Fix warning at the end of unit test run
- DEF-8417 Move firewall code into im360 package
- DEF-8422 Fix description for "Alerts total"
- DEF-8424 Adjust intensity level and resource consumption while scanning with AI-BOLIT (nice / ionice)
- DEF-8435 Move defence360/api/ips.py into im360 package
- DEF-8436 Move defence360agent/model/cache_sources.py into im360 package
- DEF-8443 Cancel background scanning when settings are changed
- DEF-8446 Move defence360agent.subsys.features into im360
- DEF-8471 Add a triangle to autocomplete in dashboard
- DEF-8489 Remove messages class dependencies from the_sink.py
- DEF-8516 Make RPC handlers registration explicit
- DEF-8531 Add to release of agent 4.2.0 new package of proactive defence 4.2.0
- DEF-8536 Disable integration with CSF via settings - UI


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.2.0-3
changelog:
- DEF-7792: Plesk - display installation progress in UI
- DEF-8480 extend UI tests for intensity level sliders
- DEF-8480 Adjust intensity level and resource consumption while scanning with AI-BOLIT (nice / ionice) - UI
- DEF-8358 Screen resolution and other browser's parameters reporting to CH


author: Timur Irmatov <tirmatov@cloudlinux.com> 4.2.2-1
changelog:
- DEF-8629 Waiting captcha instead of reading the log in captcha behave test
- DEF-8731 Fixed chkserv config
- DEF-8757 Fix missing Sentry tags
- DEF-8687 imunify360 is scanning php session files too
- DEF-8758 Failed to find '('Duplicate submission to Revisium',)' in 300 seconds


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.2.3-3
changelog:
- DEF-8761 Sometimes Apache-Error line dosn't have ModSecurity part so we've added condition to handle it
- DEF-8768 Fix lsof pat
- Bump ossec version to 3.1.0-29
- DEF-8838: bump aibolit to 4.0.2-1
- DEF-8845: bump webshield version to 1.7-12
- DEF-8836: bump i360-php to 4.2.0-1.20
- DEF-8420 Use koji repository in e2e tests to prevent issues related to gradual rollout
- DEF-7932 alert's processing is stopped for manually added ips
- DEF-8716: Adapted for new Ubuntu 18 image


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.2.4-1
changelog:
- DEF-8922: bump php-i360 version to 4.2.2-1.2
- DEF-8919: bump ossec version to 3.1.0-30
- DEF-7450 minor fixes in Plesk extension
- DEF-7450 update Plesk extension changelog and screenshots
- DEF-8904 fix upgrade_url for ImunifyAV
- DEF-8777 fix duplicated admin contacts modals after EULA


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.2.5-3
changelog:
- DEF-7102: [RPM test failed] feature_hardened-php.Hardened-PHP feature.Install/remove hardened-php
- DEF-8976 Fix test_multipackages.test_stable_develop
- DEF-8928: KeyError 'license_type' add license_type = None if there is no valid token
- DEF-8996 bump php-i360 version to 4.2.2-1.4
- DEF-6849: Add updating directadmin license in provision
- ICPD-437 Remove alt-php opcache from OS image (workaround)


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.2.6-4
changelog:
- DEF-9121 update proactive (php-i360) to 4.2.5-1.1
- DEF-8639 Investigate and fix agent response validation errors
- DEF-8968 Check schema validation
- DEF-8786 Additional properties are not allowed
- DEF-9105 update proactive (php-i360) to 4.2.2-1.8
- ICPD-489 Blamer file get filtered by CSF
- ICPD-496 Improve hash calculation for event ID in the reducer algorithm
- DEF-9098 update webshield to 1.7-13
- DEF-9078 update ai-bolit to 4.0.3-1
- DEF-9084 Disable native feature management in ImunifyAV/AV+
- DEF-9089 remove news from av-client side


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.2.7-1
changelog:
- DEF-9022 Allow 'week' and 'day' for MALWARE_SCAN_SCHEDULE.interval in AV+
- DEF-9318 Support new format of modsec_audit.log in concurrent mode.
- DEF-9352 Implement --intensity which is joint of --intensity-cpu and --intensity-io


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.3.0-2
changelog:
- ICPD-543 Bump php-i360 version to 4.2.5-1.3
- DEF-9353 test_web_scanner fails on multiple configurations


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.3.2-1
changelog:
- Bump AI-BOLIT version to 4.1.2-3
- DEF-9587 TypeError: <bound method MalwareAction.quarantine_hits_detect of <class 'im360.malwarelib.subsys.malware.MalwareAction'>> is not JSON serializable
- Fixed ossec version in Requires
- DEF-9619: Enabled rapid scan in RPM tests
- DEF-9420: Fixed captcha_dos plugin
- DEF-9554 Migration failed: 128_move_cleanup_storage_files (fix 2)
- DEF-9564: wrong method for SensorAlert


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.3.4-2
changelog:
- DEF-9704 treat expiration that is close to the current time as expired
- DEF-9421: set max limit for ipset timeout value
- DEF-9575: process suspended support request
- DEF-9616 Modsec scan still broken
- DEF-9597: fixed record captchados_alert


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.3.5-1
changelog:
- DEF-9561 Support many volumes in acronis backup
- DEF-9700 Cleanup 2 users at once - results disappear


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.3.11-3
changelog:
- DEF-10467 Wrong symlink to malware_found.list on fresh install Centos6 cpanel
- DEF-10075 [Response validation] 'running' is not one of ['stopped']
- DEF-10328 Suspicious files are not uploaded to IRMA (no uploaded events in mrs_events table)
- DEF-10429 Do not set umask during agent start on CentOS6
- DEF-10431 cPanel service manager restarts agent during migration


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.4.2-2
changelog:
- DEF-10328 - Suspicious files are not uploaded to IRMA (no uploaded events in mrs_events table)
- DEF-10404 - Duplicated record added to malicious table after restore-original with enable_scan_inotify=true
- DEF-10447 - Add encoding to im360 scripts
- DEF-10522 - Updated pam and proactive defence deps


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.4.3-2
changelog:
- DEF-10414 [AI-BOLIT] aibolit socket: Connection refused
- DEF-10592 Do not drop packets on ports which not used by webshield
- DEF-10418 [AI-BOLIT] Add logging to aibolit resident mode
- DEF-10469 AI-BOLIT supports new hash API format with verdicts
- DEF-10606 Revert modsec upload script to python version


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.4.4-2
changelog:
- DEF-10643 limit number of workers for default executor
- DEF-10702 fix error message for IPSetNotFoundError on ipset restore
- Bump webshield version to 1.8-18
- DEF-10672 TypeError: sequence item 1: expected str instance, int found
- DEF-10453 fix test_pam
- DEF-10645 test_cloud_assisted_scan fails


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.4.5-1
changelog:
- DEF-10798 (Re)Enable memory management for AI-BOLIT
- DEF-10792 PAM brute-force attack protection - issue with crontab access on CentOS 6


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.4.6-2
changelog:
- DEF-10928 apache couldn't start due to selinux permissions of imunify files
- DEF-10956 security fix


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.5.1-2
changelog:
- DEF-10928 apache couldn't start due to selinux permissions of imunify files
- DEF-10835 Fix /var/imunify360/aibolit/run/*/pid: No such file or directory
- DEF-10956 Security fix
- DEF-10931 Skip the sections in the integration.conf that are not mandatory


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.5.5-1
changelog:
- DEF-11204 Real-time scanner incidents don't follow symlinks
- bump ai-bolit to 1:20.0212-1 and pam to 0.3.8 versions


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.6.1-9
changelog:
- DEF-11363 Getting invalid PROACTIVE_QUEUE_LIST messages on correlation server
- DEF-11376 Proactive defense DB migration - incorrect order of fields
- DEF-11328 After installing 360 dovecot logins getting failed on update
- DEF-11398 Improve message for SMTP traffic conflict


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.6.2-2
changelog:
- DEF-11433 Cannot restore cleaned-up file after it was scanned again
- DEF-11385 apache failed to reload in test_disabled_waf_engine_plesk
- DEF-11510 ModSecurity Issues - Failed uploads via WordPress/Joomla Editor
- DEF-11497 Realtime scan should ignore root-owned files
- DEF-11535 imunify-realtime-av: Realtime scan should ignore root-owned files


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.6.3-1
changelog:
- DEF-11440 Fixed setup_cagefs.py to work with new CL release
- New PD kill rule True-Positive causes issues to WP admin


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.6.4-2
changelog:
- DEF-11611 Cleanup fails due to permissions of /var/imunify360/files/sigs/v1/aibolit/procu2.db
- DEF-11626 agent_rpm_version and agent_proto_ver are empty for all im360 v4.6.x events


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.7.0-3
changelog:
- DEF-11317 master.test_smtp_blocking.test_rules_created_on_start[filter]
- DEF-11443 Do not enable/disable agent in systemd during registration
- DEF-11539 Rules update may overwrite edits in `123_Disable_WP_Redirect`
- DEF-11542 Handle php parameters in ai-bolit go-wrapper
- DEF-11543 ai-bolit wrapper: data collector paths mismatch
- DEF-11597 test_modsec_redirect_with_compromised_wp_account failed in multiple configurations
- DEF-11611 Cleanup fails due to permissions of /var/imunify360/files/sigs/v1/aibolit/procu2.db
- DEF-11626 Clickhouse proactive_queue agent_rpm_version and agent_proto_ver are empty for all im360 v4.6.x events
- DEF-11667 simple pass redirect does not work correctly on installations with reverse proxy
- DEF-10362 WordPress Simple Password brute prevention
- DEF-10853 Improve ionice management for the schedulers deadline and noop while running AI-BOLIT
- DEF-10997 Update defaults for malware scanner settings for new installation
- DEF-10438 [AI-BOLIT] PHP data collection script
- DEF-10793 Send additional information to Clickhouse from modsec_audit.log
- DEF-10854 UI - add warnings if none of the limitation mechanics are supported
- DEF-10891 Agent - return warnings if none of the limitation mechanics are supported
- DEF-11010 Update defaults for malware scanner settings
- DEF-11021 Manage modsec rule depending on UI setting (activate/deactivate)
- DEF-11133 Detect applicable limit mode on Agent startup (LVE / CGroups / ionice)
- DEF-11134 Provide ability to set limitations via LVE
- DEF-11240 Update config file atomically
- DEF-11253 Change test_modsec_rules.test_modsec_rule_sensor_incident_creation to do not belong on log records
- DEF-11295 Make brute-prevention page compatible with the new modsec rule
- DEF-11297 Resolve exploitability in the https://security.imunify.com/ page
- DEF-11319 Remove “Experimental” under Rapid Scan and update text
- DEF-11382 modsec scan script leaves temporary files in upload-jobs
- DEF-11448 Implement RPM test for scan intensity
- DEF-11452 Install lve-wrappers automatically
- DEF-11529 Use go-wrapper for AI-BOLIT
- DEF-11530 Add executable bit to wrapper binary
- DEF-11538 Move proactive socket to /opt - PHP daemon
- DEF-11633 Add "experimental" label to wordpress account compromise prevention option in settings
- DEF-11666 minidaemon: allow new socket location for proactive defence
- DEF-11670 Integrate ai-bolit 20.0325
- DEF-11673 Implement new redirect strategy for brute prevention.
- DEF-11675 Remove "EXPERIMENTAL" from the clean-up elements


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.7.1-4
changelog:
- DEF-11774 Use intensity settings from config as default to scan
- Bump ai-bolit and imunify360-php-i360 versions
- DEF-11632 Standalone ImAV has only 3 tabs in UI ( Files, History, Ignore list)


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.7.2-2
changelog:
- DEF-11853 update proactive defence package
- Bump imunify-realtime-av to 1.0.4-1
- DEF-11820 Return warning about csf in smtp blocking config section
- Update deploy scripts


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.7.3-3
changelog:
- DEF-12012 Limit notify queue size for aibolit
- DEF-11994 Do not remove php repos on update
- Bump webshield to 1.11-1
- DEF-11941 Don't try to use LVE on non-CL systems
- DEF-11968 bump php-i360 version to 4.7.0-1.17
- Bump ai-bolit to 20.0414-1
- Bump imunify-realtime-av to 1.0.6-1
- DEF-11945 Disable "Optimize realtime scan" setting on CL systems


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.7.4-2
changelog:
- Revert "DEF-11510 Set timeout for modsec upload in bash wrapper"
- DEF-11506 do not restart csf if not need from import_wblist plugin
- DEF-12134 Rebuild webshield with updated OpenSSL
- DEF-12008 phpMyAdmin unintentionally drops other users dbs


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.8.0-5
changelog:
- DEF-11436 Plesk backups say "some minor issues occurred" due to permissions errors on file: .rapid-scan-db
- DEF-11808 Security Message on Plesk due to /httpdocs/wp-content/.rapid-scan-db owned by "root"
- DEF-12067 Webshield Captcha system bug (Deliver captchas are being for any request, not to just Mime Type text/html)
- DEF-10126 Failed to parse cleanup report: b'Loaded External DB
- DEF-10432 OperationalError: user-defined function raised exception
- DEF-10625 master.test_malware.test_cleanup.test_cleanup_not_blocking
- DEF-11268 KeyError: 'getpwuid(): uid not found: 100'
- DEF-11275 Change progress tracking from finder to ai-bolit wrapper
- DEF-11506 master.test_csf_allow_ignore.test_csf_ignore[csf.ignore]
- DEF-11513 KeyError: 'getpwnam(): name not found: admin' in ["login", "get"] rpc command
- DEF-11567 Bunch of tests fail with "On-demand scan is already running" error
- DEF-11568 Do not send exceptions from 'malware', 'read' to sentry
- DEF-11577 KeyError: 'MALWARE_SCANNING'
- DEF-11616 Error during registration when agent is not started
- DEF-11662 test_malware_scan_task fails on Ubuntu + Plesk
- DEF-11729 "Blocked ports.Add/delete port" behave test fails on CL7 CSF conf
- DEF-11743 Detect crashed detached scan
- DEF-11794 FileExistsError: [Errno 17] File exists: '/var/imunify360/aibolit/run/177357b34f11468b97c9a03a1683a927'
- DEF-11842 test_malware.test_quarantine.test_reinfection failed
- DEF-11847 malware tests failed on AV (rpm-tests)
- DEF-11879 test_detached_scan_messages.test_malware_scan_messages_order failed
- DEF-11907 test_proactive failed (RPM-tests)
- DEF-11922 "blacklist ip add" may produce misleading error message & docs are unclear
- DEF-11923 total_files always 0 from malware on-demand list output
- DEF-11924 ValueError: invalid literal for int() with base 10: '12.5'
- DEF-11938 test_hooks failed (RPM-tests)
- DEF-11972 Pass correct arguments to scan the file from backup
- DEF-11989 Fix external finder for malware scan task
- DEF-11990 'user list' shows that user has no malware when malware exists, after interrupted scan
- DEF-11997 Fix nav badge
- DEF-12034 PAM switches abnormal behavior with OSSEC
- DEF-12043 [AppVersionDetector] It took almost 1 hour for app version detector to scan 1000 domains
- DEF-12138 UnicodeDecodeError: 'utf-8' codec can't decode byte 0x89 in position 0: invalid start byte
- DEF-12163 server loses an UNacknowledged persistent message if agent is restarted
- DEF-12218 Failed test test_sa_hacker_trap_included related to exclude list in proactive defence
- DEF-12244 enabling 'known_proxy_support' can raise number of pending connections (in TIME_WAIT state)
- DEF-9331 Imunify360 rules management based on detected apps per folder/per user basis
- DEF-10639 [AI-BOLIT] Scan List Preparation inside ai-bolit
- DEF-11139 extending dir list for inotify/fanotify
- DEF-11191 Persistent messages flow implementation
- DEF-11229 LiteSpeed support for noCP version of Imunify360
- DEF-11233 Make clean-up results visible and clear for customers
- DEF-11652 Enable scan for end-users in IM360/AV
- DEF-9823 [WAF Ruleset Configurator] - changes in settings tab
- DEF-10651 Check current iNotify directory list and extend to meet performance requirements on CPU/IO/memory
- DEF-10676 [AI-BOLIT] scan list preparation in ai-bolit
- DEF-10800 Test account in OpenLitespeed rpm tests is not created in feature management tests
- DEF-10801 Adjust python code to no longer watch for updated files to scan
- DEF-10875 Need to make in Agent the switcher for using the internal scan list of files and externa(ai-bolit)
- DEF-11022 Add MOD_SEC.app_specific_ruleset config option
- DEF-11023 Add call to obtain DocumentRoot for all domains
- DEF-11027 Refresh app-versions and app-specific ruleset once a day
- DEF-11028 Map AppVersionDetector data to modsecurity tags
- DEF-11030 Add call to refresh app-specific modes configuration file
- DEF-11033 [AppVersionDetector] AppDetector's report schema refactoring
- DEF-11035 Add update-app-specific-rules RPC call
- DEF-11036 Refresh app-specific ruleset on modsec rules update
- DEF-11050 Implement web server graceful restart procedure
- DEF-11052 Create RPM tests for app-specific ruleset feature
- DEF-11201 Add a config option to enable/disable Low Volume (D)DoS protection
- DEF-11208 [SQLite AI-BOLIT output Collect required changes on Agent side
- DEF-11228 Convert "Tests for fields -> SMTP_BLOCKING" e2e tests to unit/app tests
- DEF-11318 Research and decompose OpenLiteSpeed support for Standalone Imunify360
- DEF-11344 Stand-Alone (noCP) config automatic migration for monitoring directories
- DEF-11357 Parametrize existing tests of on-demand scan to use internal/external finder
- DEF-11358 Write test to cover external finder
- DEF-11460 Update user's infected count only on user scan
- DEF-11544 Probable race condition while cleaning up files
- DEF-11566 Implement persistent message flow on agent side
- DEF-11592 Update "Clean" status in malware scanner's user list
- DEF-11596 Update found malware chart in dashboard
- DEF-11617 Integrate Imunify with AppVersionDetector
- DEF-11621 [AppVersionDetector] Need to write build script and set up build project
- DEF-11719 Remove 'filelist' fixture from RPM-tests
- DEF-11731 Remove file from malware_standalone.list on marking file as false positive
- DEF-11742 Implement generation of configs by imunify360-agent
- DEF-11750 Do not restart webserver if rbl whitelist was not changed.
- DEF-11799 Add Plesk support license to the Imunify360
- DEF-11825 Increase MAXELEM in ipset configuration
- DEF-11921 Add AI-BOLIT stderr/stdout to MalwareScan report for debug purposes
- DEF-11952 I360.so is absent for php7.4 on Ubuntu ( plesk)
- DEF-11956 Try to check how pam_imunify can break dovecot on cPanel after imunify deinstallation
- DEF-11985 Change MRS size limit exceeded error to warning
- DEF-12031 Fix translations from DEF-12011
- DEF-12040 test_ondemand_queue.TestQueueRemove.test_remove_any fails
- DEF-12045 E-mail archiving conflicting with Imunify360
- DEF-12123 AppVersionDetector should be executed using nice/ionice (or LVE is available) to limit consumed resources
- DEF-12168 Add validation for paths read from malware path filters
- DEF-12276 Multiple RPM tests failures related to realtime scan
- DEF-12299 Rework "Wordpress Account Compromise Alert" page
- DEF-12305 Define $captcha_key as wscheck module C variable


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 4.8.1-2
changelog:
- DEF-12394 SMF got 503 error (blamer issue)
- DEF-12360 config.py defaults of rapid_scan and schedule interval should match imunify360.yaml
- DEF-12429 Update ignored regexps


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.8.3-2
changelog:
- Bump proactive version to 4.8.0-1.16
- DEF-9832 Exclude lightspeed cache folder from the list of scan folders
- Remove *.config and *.cfg files from ignored


author: Pavel Zaikin <pzaikin@cloudlinux.com> 4.9.0
changelog:
- Revert "DEF-12635 Enable imunify360 service on every update"
- DEF-12500 Improve webshield-related rpm-tests
- Bump webshield version to 1.12-2
- DEF-11677 Increase startup waiting timeout
- DEF-12669 Remove clamav from /etc/cagefs/cagefs.mp
- Bump imunify-realtime-av to 2.1.2-1
- Add rpm-test to check unexpected rules recreation
- DEF-12638 workaround for check iptables on CentOS8
- Bump webshield version to 1.12-1
- Skip test_webshield for antivirus mode
- Bump ai-bolit version to 20.0601
- DEF-12661 TypeError: unorderable types: NoneType() > int()
- Fix args for assign_cert Panel method in rpm-tests
- DEF-12635 Enable imunify360 service on every update
- DEF-12609 Added webshield-modsecurity 3.0.4-2 to extra_repos
- DEF-12609 Replaced CentOS8-generic with CL8-generic
- DEF-12500 Enable webshield-related rpm tests for generic panel
- Bump proactive version to 4.9.0-1.3
- DEF-12627 Split cleanup file list by chunks
- DEF-12274: Put realtime av scanner configs to files server
- DEF-12455 add pytest-rerunfailures pytest-plugin
- DEF-12609 Do not add koji repo for CL8
- DEF-12387 Issues with Imunify uninstall
- DEF-12575 Wait users to be removed from packages
- DEF-12578: Fix validation error on RULE_DISABLED msg
- DEF-9832 Exclude lightspeed cache folder from the list of scan folders
- DEF-12514 several test_socket_activation rpm tests failed on multiple configurations
- DEF-11268 KeyError: 'getpwuid(): uid not found: 100'
- DEF-9502 Add unit test for deploy.sh
- DEF-12437: Add body size to correlation middleware metric
- DEF-12323 increase count of attempts in test ossec_pam integration
- DEF-12238: Prepare MRS for increased load
- DEF-12524 Implement a rotation for CAPTCHA keys
- DEF-12140 WebShield: add save new CAPTHA keys in agent's config. New UI fields
- DEF-12288: persistent messages that are sent via Correlation UI are not delivered sometimes DEF-12288: Temporarely disable connection from limiting traffic
- DEF-12339 Updated eula
- DEF-11797 switcher for json/csv format of ai-bolit reports
- DEF-12323 add rpm test to check ossec/pam integration (sshd)
- DEF-12548 Remove some experimental badges in UI
- DEF-12575 Remove account before package
- DEFA-2606 Greylisting if AR and PAM are disabled. ossec 3.1.0-74
- DEF-11931: Fix adding field to the wrong table
- DEF-12486 Fixed test_dos_detector
- DEF-12001 fix fields order in migration 143
- DEF-12497 Update of Imunify360-firewall resets backup settings
- DEF-12449 add timeout to SendMessageAPI
- DEF-11291 Fix 'cmd' appears instead of 'args' for cleanup
- DEF-9502 Update panel detection in deploy.sh
- DEF-9612 [Sentry] `get-news` throws an error: "ParseError no element found: line 1, column 0"
- DEF-12494 Fix ui e2e tests
- DEF-12493 Make create_build.py work with new release pointers
- DEF-12495: Add `system_id` field to the `/api/app-version-save` endpoint
- DEF-12484: Update and enable dashboard recommendations
- DEF-12454 New Caledonia Icon Flag Broken in IM360 UI
- DEF-12265: Create /api/ip endpoint
- DEF-12261 Added ossec-remoted to csf.pignore
- DEF-11290 Fix 'default_action' and 'try_restore' appears in wrong place
- DEF-11289 Fix 'cmd' appears instead of 'args'
- DEF-12303 Change core version for Centos8 to support by kernelcare
- DEF-12023 use machine readable format in extra_repos
- DEF-12383 Warning in UI / Settings
- DEF-11822 Do not acquire CSF lock for rules check
- DEF-12416 LogReader should not write to console.log
- DEF-12434: Add src_ip to xray requests and tables
- DEF-12429 Update ignored regexps
- DEF-12360 config.py defaults of rapid_scan and schedule interval should match imunify360.yaml
- DEF-12271: Add verdicts on MRS to monitoring
- DEF-12342 Do not fail installation if install-vendors fails
- DEF-11904 Create rpc methods for enduser scan - cover with agent unit tests
- DEF-12366 Imunify360 UI wont save changes to "Max Connections" & "Check delay" under Settings > General > DoS Protection
- DEF-12250: Add license field in correlation API send-message endpoint
- DEF-12414: Add jwt token check for xray
- DEF-12208 add logging and finally_happened to first check in test_sa_hacker_trap_included
- DEF-12456 Skip test_atomic_reload_custom_iplist for antivirus mode
- DEF-12310 add basic integration test
- DEF-12352 ValueError: invalid literal for int() with base 10: ''
- DEF-11839 on-demand scan removes previously detected malware hits
- DEF-12319 AttributeError: 'NoneType' object has no attribute 'process_message'
- DEF-11937 Use swap to reset ipsets atomic
- DEF-12324 Show a warning and disable "SMTP Traffic Management" in UI if a similar feature is provided by hosting panel
- DEF-11195: src/smart-block reformat
- DEF-12396 CentOS 8/CLOS 8/RHEL 8 support - create generic image for ui e2e tests
- DEF-12396 CentOS 8/CLOS 8/RHEL 8 support - create generic image for ui e2e tests
- DEF-12389 CentOS 8/CLOS 8/RHEL 8 support - create plesk image for ui e2e tests
- DEF-12391 Purge ClamAV
- DEF-12364: Fix modsec rules deploy on correlation-ui
- DEF-12001 Add plugin MrProper and cleaners
- DEF-12050: Notify agent that new autorules.yaml is ready
- DEF-12373: PHP-daemon: error #503
- DEF-12327: Fix bug in connection DEF-12327: Fix invalid fingerprinting
- DEF-11195: Add black formatting for all subprojects
- DEF-11195: src/mrs-services reformat
- DEF-11195: src/integration-tests reformat
- DEF-11195: src/git-doc reformat
- DEF-11195: src/files reformat
- DEF-11195: src/events reformat
- DEF-12152 fix some texts
- DEF-12152 restore-from-backup request should not block UI - UI part
- DEF-11112 Update provision for Centos/CL8 generic panel
- DEF-12210 Ensure fail2ban is running if enabled
- DEF-12283 CentOS 8/CLOS 8/RHEL 8 support - create centos8-directadmin image for ui e2e tests
- DEF-11397: Add files.imunify360.com to monitoring
- DEF-12299 Rework "Wordpress Account Compromise Alert" page
- DEF-11718 Bypass scan by trailing space in file name
- DEF-11882 test_socket_activation.test_socket_activation_long_action failed
- DEF-11111 Update provision for Centos/CL 8
- DEF-11556: Check system_id query parameter in auth
- DEF-9279 Remove Acronis agent if it was installed by us. Do not ask in i360deploy.sh
- DEF-12327: Fix bug in connection
- DEF-11556: system_id sync
- DEF-12345: Write errors in parsing msg to warning
- DEF-12124: Document deploy process for xray.js file
- DEF-12011 client wants to use language that is different from the Plesk default language
- DEF-12345: Write errors in parsing msg to warning
- DEF-12129: add RPM tests to cover new imunify-realtime-av spec
- DEF-7042 Hash in the DB does not match real file hash
- DEF-12251: Send MongoDB collections sizes to monitoring
- DEF-11556: Create temporary mock
- DEF-11897: Deploy and check correlation-ui
- DEF-12302 Fix retries in tests - zone.js do not seem to work in node
- DEF-11731: Remove file from malware_standalone.list
- DEF-12021: Impelement new end-point and new tables for saving of statistics about clients rpm packages
- DEF-12151 restore-from-backup request should not block UI - agent part
- DEF-12043 Set scan-depth=2 for app version detector
- DEF-12034 fix switching ossec config on pam settings change
- DEF-12276 Fix realtime scanner RPM tests
- DEF-11840 Use new cloud for test images
- DEF-11923 total_files always 0 from malware on-demand list output
- DEF-11755 Bulk actions to blacklist/whitelist IPs - implement
- DEF-11701: Setup monitoring to jenkins worker nodes
- DEF-11329: Run correlation API with 4 workers
- DEF-12239: Fix haproxy 502 errors
- DEF-11110 CentOS 8/CLOS 8/RHEL 8 support - create image for ui e2e tests
- DEF-12236 Link to settings from restore-from-quarantine modal do not remove modal backdrop in plesk
- DEF-11840 Use nebula credentials from jenkins
- DEF-11878 Allow to run e2e tests on dev-server
- Revert "DEF-11510 Disable test_web_scanner in container"
- DEF-11650 Typo in the UI PLESK in Imunify360 extension
- DEF-12240: Return user scan endpoints
- DEF-12138 Handle non-unicode symbols in ai-bolit output
- DEF-12132 Typo in "WordPress Account Compomise"
- DEF-12153: Cache the results of restore-from-backup
- DEF-11812: Replace "--skip-root-owner" with "--skip-system-owner" ai-bolit paramter in the agent
- DEF-11108 Add ability to build imunify package on Centos/CL 8
- DEF-11290 Add default_action to MalwareScan report
- DEF-11289 Add AI-BOLIT args to MalwareScan report
- DEF-11291 Add procu2 args to MalwareCleanup report
- DEF-11106 CentOS 8/CLOS 8/RHEL 8 support - deployscripts


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.9.2-2
changelog:
- Bump ai-bolit version to 20.0619-1
- Bump webshield version to 1.12-5
- DEF-12636 - [AI-BOLIT] deobfuscator can't deobfuscate the sample 1848f147c179962d9626b8934f7d7503c74722adcaac4543eee952a406285390
- DEF-12651 - Customers download the wrong ModSec ruleset
- DEF-12663 - [AI-BOLIT] deobfuscator can't deobfuscate the sample 9575b0ddf36a146bec7d1e910f4aad05c61493df82eb0c3ef0bc17740516dfde
- DEF-12689 - Webshield does not process IPv6 /64 networks
- DEF-12716 - [AI-BOLIT] deobfuscator can't deobfuscate the sample f4d3270906909dcf30c0f2394c8500bb654eca56918dbe8140d2a3223287f8de
- DEF-12718 - [AI-BOLIT] deobfuscator can't deobfuscate the sample 8ba86b71b3f3a66530fa8f99e9f27b872eb6377e27600bc4e183a03e2f9e6376
- DEF-12721 - Find out how 'upstream' block can be added to webshield configuration
- DEF-12749 - [AI-BOLIT] Signature is hanging the cleanup
- DEF-12767 - IntegrityError: FOREIGN KEY constraint failed
- DEF-12772 - [AI-BOLIT] Change Priority Of Cloud Assisted scan for whitelist to have higher priority over blacklist
- DEF-12783 - Something went wrong during updating captcha keys: CheckRunError(1, ['service', 'imunify360-websh...
- DEF-12799 - imunify360-php-daemon: sync: WaitGroup is reused before previous Wait has returned
- DEF-12822 - [Suggestion] Ignoring maildir path
- DEF-12823 - imunify360-php-daemon: handling of "too many open files error"
- DEF-12854 - Update proactive defence rules for 4.9.2. Make log rules as block rules


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.9.3-2
changelog:
- DEF-12953 Imunify360 doesn’t starts after update
- DEF-12850 Cleanup creates multiple rows in 'malware malicious list' output after restore from quarantine
- DEF-12928 Add iptables package to dependencies on Centos/CL 8


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.9.4-2
changelog:
- DEF-12955 imunify-realtime-av: After being continuously restarted, service enters failed state
- DEF-13002 Update rules for proactive defense 4.х. Add LOG rules for DEFA-2865


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 4.9.5-3
changelog:
- DEF-13001 Imunify UI is not available in Directadmin
- DEF-13005 No access to spam folder when exim bruteforce protection is enabled


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 4.9.6-8
changelog:
- DEF-13321 Bump php-i360 to 4.9.0-7
- Change ai-bolit version to 20.0717-1
- DEF-13271 Cleanup hackertrap on install
- DEF-13265 Remove file from HackerTrap after cleanup
- DEF-13247 add newline at the end of crontab
- DEF-13193 'on-demand queue remove' doesnt kill ai-bolit process
- DEF-13214 bump webshield version to 1.12-5.1


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 5.1.1-2
changelog:
- DEF-13615 Set cannot be destroyed: it is in use by a kernel component
- DEF-13704 Error: Incorrect padding
- DEF-13749 Whitelisted ips with full_access are incorrectly restored after service restart
- DEF-13724 disable LOG rules for whitelist


author: Pavel Zaikin <pzaikin@cloudlinux.com> 5.2.0-2
changelog:
- DEF-13811 Restored from backup files still marked as infected
- DEF-13725 Preview files from quarantine leads FileNotFoundError
- DEF-13689 Malware ignore list is not escaped when compiled into the common exclude list
- DEF-13805 Do not use make_config_active
- DEF-13741 Save current locale during saving notifications config if no locale chosen


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.2.1-1
changelog:
- DEF-13922 malware-scanning/started hook missing intensity data
- DEF-13955 imunify-realtime-av: assignment to entry in nil map
- DEF-13908 Strange ImunifyAV scan behavior


author: Pavel Zaikin <pzaikin@cloudlinux.com> 5.2.2-1
changelog:
- DEF-13961 retry on openssl Timeout error
- Bump imunify-notifier version to 1.0.6-1
- Bump specs to imunify360-php-i360-5.2.0-1.6, imunify360-php-i360-rules-5.2.0-5


author: Pavel Zaikin <pzaikin@cloudlinux.com> 5.2.3-1
changelog:
- DEF-14147 Prevent apache from failure during update
- DEF-14135 Do not check license in AV cron job


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 5.2.4-1
changelog:
- DEF-13900 Remove Debian support from deployscript
- Bump specs to imunify360-php-i360-5.2.0-1.8, imunify360-php-i360-rules-5.2.0-7


author: Oleksii Soldatienko <osoldatienko@cloudlinux.com> 5.3.1-2
changelog:
- DEF-14267 [MDS] MDS statistics doesn't send by default
- DEF-14319 duplicate real_ip_header directive can break nginx
- DEF-11526 Use appropriate locks when working with CSF


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.3.2-3
changelog:
- DEF-14421 unified-access-logger is not started together with imunify360 as required
- DEF-14406 Disable "im360-whitelist" rule in unified-access-logger


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.4.1-1
changelog:
- DEF-12767 IntegrityError: FOREIGN KEY constraint failed
- DEF-14370 Ossec services fails with changed SELinux context var_t -> var_log_t
- DEF-14624 Error 500 when IPv6: invalid port while connecting to upstream


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.4.2-2
changelog:
- DEF-14652 Research the Cloudflare's "Automatic platform optimization for WordPress"
- DEF-14672 Use tmpreaper to cleanup tmp directories
- DEF-14346 Add detection of internal data in EG(current_execute_data)->opline for ioncubeloader


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.4.6-1
changelog:
- DEF-13704 Error: Incorrect padding
- DEF-14504 update_components_versions command fails in test_app_specific_ruleset rpm tests
- DEF-14594 ScanFailed.command should be a list of strings
- DEF-14690 pytest is killed repeatedly by OOM killer on Ubuntu 1GB
- DEF-14777 test_ondemand_queue tests fail
- DEF-14853 Creating /var/log/.log after the installation
- DEF-15118 app-specific ruleset erroneously enabled with nginx_apache web server on DA


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> 5.4.8-2
changelog:
- DEF-15251 Fixed typo in lock implementation causing temporal deadlocks
- DEF-15167 Return OK with error message on memory allocation error


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> 5.4.9-2
changelog:
- DEF-15351 Add watchdog functionality to check webshield status
- DEF-15420 Enabled purging of expired records from shared memory


author: Pavel Zaikin <pzaikin@cloudlinux.com> 5.6.0-2
changelog:
- DEF-15872 Allow whitelisting subnets of blacklisted supernet
- DEF-15796 don't mention ossec package in the update command
- DEF-15778 (fix) don't use os.sync without a good reason
- DEF-12933_change_accessibility_to_alt-php74-imunify_interpreter-5.6
- DEF-15797 Move 'malware rebuild patterns' CLI schema to ImunifyAV
- DEF-15774 Added AlmaLinux support
- DEF-15671 `malware user scan` hangs if there are a lot of queued scans
- DEF-14271 Use --username key for procu2 instead of privileges dropping


author: apastushenko <apastushenko@cloudlinux.com> 8.13.1-1
changelog:
- Add embedded NATS server for cross-component messaging (DEF-39879)
- NATS enabled by default (I360_NATS_ENABLED), runs alongside fgw
- Localhost TCP transport with token auth, JetStream file-backed persistence
- Prometheus metrics collector for NATS monitoring


changelog: - Initial geodb data
author:
Nikolay Telepenin <ntelepenin@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 16.01.04-2


author: Pavel Kondratyev <pkondratyev@cloudlinux.com> 6.0.0-4
changelog:
- DEF-17961:
  Checks for socket errors,reload daemon if detected
  Scan splitter function accepts only one message to eliminate possible delay in closing the socket
  Increase service max fd's


author: Svyatoslav Gormash <sgormash@cloudlinux.com> 3.1.0-108
changelog:
- WPT-60 Add support for PostgreSQL log monitoring
- added service restart after upgrade. Version bump.


author: Sergey Fokin <sfokin@cloudlinux.com> - 3.1.0-45
changelog:
- add /etc/rules_pam.d/320_pam_switch.xml
- add /var/ossec/etc/ossec-pam.conf
- remove /var/ossec/rules/exclusion_rules.xml


author: Svyatoslav Gormash <sgormash@cloudlinux.com> - 3.1.0-69
changelog:
- Removed greylisting with disabled ActiveResponse
- Suppress verbose output in post-install scripts


author: Svyatoslav Gormash <sgormash@cloudlinux.com> - 3.1.0-71
changelog:
- Merged ossec-pam.conf and ossec-no-pam.conf to ossec.conf
- Active Response scripts won't check imunify360.conf


author: Denis Patrikeev <dpatrikeev@cloudlinux.com> - 3.1.0-77
changelog:
- apply ownership/permissions info from the ossec spec on /var/ossec
- don't use *.uid/.gid files -> corresponding ids may have been
  reused by unrelated users/groups by now
- append .rpmsave suffix to files & subdirs from known %files %dir
  dirs if they are not owned by root or ossec\* users


author: Svyatoslav Gormash <sgormash@cloudlinux.com> - 3.7.0-12
changelog:
- WPT-1623 Remove lsof call from Active Response scripts for better performance 
- DEF-35839 Remove leftover cronjob on uninstall


author: Alexey Berezhok <aberezhok@cloudlinux.com> 0.3-15
changelog:
- DEF-12045: E-mail archiving conflicting with Imunify360
- DEF-11958: investigate the ability to decrease a number of appeals to RBL


author:
Pavel Artsishevsky <partsishevsky@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 0.4-14

changelog:
- DEF-12707: Add database open failover step
- ICPD-740: Removed "Not found in block list" from secure logs
- ICPD-782: Generating of NEW_UUID can by heavy for CPU, we need to avoid such behavior
- DEF-11959: Add support pam to the PureFTPD for cPanel
- DEF-11960: Check when fix for ProftPD will be available in latest release
- DEF-12365: rpm-tests: test_pam.test_ip_blocked irreproducible bug
- DEF-12471: Add --dry-run command for imunify360-pam eanble/disable
- DEF-12753: Security flaw in world writable directory
- DEF-12317: CheckRunError: Command - fix
- DEF-13005: No access to spam folder when exim bruteforce protection is enabled


author: Oleksiy Shchukin <oshchukin@cloudlinux.com>, Eugene Vodilov <evodilov@cloudlinux.com> 5.3.0-4
changelog:
- DEF-14014: Add filtering stats fom 127.0.0.1 ip, add service name passing from c module to daemon
- DEF-13694: Add saving successful tries to the corellation server
- DEF-13229: Add saving unsuccessful tries to the corellation server
- DEF-13928: fix for failed to start PAM


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.6.0-3
changelog:
- DEF-16132: Bump pam_imunify_daemon startup timeout to 120 seconds
- DEF-15946: pam_imunify_daemon ftp integration watchdog


author: Oleksiy Shchukin <oshchukin@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 5.7.0-1
changelog:
- DEF-15634: ProFTPD support better diagnostic message
- DEF-15279: Make error as warning
- DEF-15683: Add command of rebuild local template for dovecot without builddovecotconf and restarting dovecot. it needs for cPanel


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.7.0-9
changelog:
- DEF-16549: Fix pam_imunify_daemon SIGPIPE handling
- DEF-16428: Fix pure-ftpd is restarting in an infinite loop


author: Husein Haidarov <hhaidarov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.4.0-1
changelog:
- DEF-18649: remove other users access to app data (fix initscript)
- DEF-18818 DEF-15279 DEF-18577: Misc fixes


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.4.0-3
changelog:
- DEF-19112: whitelisted_ips_include in PAM ini lacks of litespeed modsec path
- DEF-18996: Fix "PAM daemon starts before RPM transaction finishes" error


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com>, 6.4.1-1
changelog:
- DEF-14950: rate limit "no space left on device" errors
- DEF-19519: rate limit "operation not permitted" errors


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.5-1
changelog:
- DEF-23446: use yaml style in cpanel pure-ftpd config, trigger /scripts/setupftpserver on pure-ftpd enable/disable
- DEF-23541: ignore nano version when linking i360_auth to i360_lib
- DEF-23503: reduce network timeouts in pam module, pam daemon and native dovecot module


author: Pavel Zaikin <pzaikin@cloudlinux.com> 6.4.5-2
changelog:
- DEF-24182 use imunify360-venv for python scripts 
- DEF-24430: Install go-licenses v1.6.0 for current go version


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.6-1
changelog:
- DEF-25203: add LimitNOFILE value to imunify360-pam.service to raise limit of open file descriptors
- DEF-25862: fix osv-scanner vulnerabilities by updating go version and versions of go modules
- DEF-26053: build imunify360-pam for Debian 12
- DEF-26170: remove /usr/lib64/dovecot/|/lib64/dovecot path on DirectAdmin, version 6.4.6-1 only


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.7-1
changelog:
- DEF-27057: add pure-ftpd hook to enable imunify360-pam pure-ftpd after /scripts/setupftpserver execution disables it on cPanel
- DEF-26992: replace python wrapper with FailureWatchdog go code on systemd
- DEF-27119: add systemd activation sockets, add ConnTracker to track idleness
- DEF-25512: fix imunify360-pam status command


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.8-1
changelog:
- DEF-29380: replace None value in get_cp_name return value with 'generic'
- DEF-28575: use wafd's iplist service for whitelisted ips
- DEF-28697: use local version identifier instead of hyphen in setup.py
- DEF-29884: add support for dovecot-2.3.21
- DEF-29917: validate license against alternative public key when present


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.9-1
changelog:
- DEF-29976: add support for Ubuntu 24
- DEF-28659: remove centos6/cl6 support
- DEF-24286: do not log to syslog syscall.EPIPE errors on closed connections


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.10-1
changelog:
- DEF-32268: wrap logging init in try except block
- DEF-30929: use /usr/lib/security location instead of /lib/security only on ubuntu24 and debian12


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.12-1
changelog:
- DEF-35434: add dovecot-native support for dovecot-2.4
- DEF-37172: add dovecot-pam support for dovecot-2.4


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.13-1
changelog:
- DEF-36381: build imunify360-pam for Debian 13
- DEF-37452: add dovecot-native support for dovecot-2.4.2
- DEF-37502: fix domainowner regex in dovecot-pam mode for dovecot versions higher than 2.4


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 6.4.14-1
changelog:
- DEF-37513: remove symlink if dovecot version is not supported
- DEF-38098: free post_set settings in native dovecot-2.4


author: Pavel Kuzmuk <pkuzmuk@cloudlinux.com> - 1.1.5-3
changelog:
- Reset stats after each send
- DEF-13075 send stats to Correlation server
- Move agent config to separate package
- DEF-12858 Change some messages' levels to debug
- Change stats interval to 1 hour


author: Timur Irmatov <tirmatov@cloudlinux.com> - 1.1.6-1
changelog:
- Update cln-pub.key location
- Review and improve test coverage
- Add generating coverage report in Cobertura format
- Silence useless sentry message


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> - 2.0.2-2
changelog:
- DEF-16651: implement retries when sending data to correlation
- DEF-16812 update license
- DEF-16787 use commit hash in gerrit builds
- DEF-16747: Change sentry DSN
- DEF-16574: fix SIGPIPE handling
- Fix CentOS 6 detection


author: Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 2.0.3-1
changelog:
- DEF-19446: Blamer: make function of filtering of store events from PD to disk-based storage
- DEF-19447: Blamer: send events that correspond to malware in agent SQLite DB
- DEF-19445: Blamer: implement disk-based storage for `phpfp_d`-aggregated events
- DEF-19448: Blamer: clean-up events that are unlikely to get detected by the malware scanner
- DEF-19450: Blamer: extend statistics reporting
- DEF-19618: Blamer: extend statistics reporting related to disk-based storage
- DEF-19619: [PHP Daemon] Fix reporting of the Proactive Defense package version


author: Dmitry Baynak <dbaynak@cloudlinux.com> 2.0.4-1
changelog:
- DEF-19879: Blamer: check feature performance impact and consider event limits
- DEF-19841: Add field in the message for CH which points the source of blamer messages (new mechanism or old)


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 2.0.5-2
changelog:
- DEF-20217: Purge PHP minidaemon db on [re]install to avoid excessive sentry errors
- DEF-20254: Fixup imunify360-php-daemon.service fails to start bug
- DEF-20391: The fix for excessive blamer message parsing errors


author: Eugene Vodilov <evodilov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.2.2-1
changelog:
- DEF-19294: Merge imunify360-php-i360-rules back to imunify360-php-i360
- DEF-19173: Move from using libffi, or try to use some other arch for avoid segfaults on AMD
- DEF-19302: Add reporting to clickhouse Proactive Defense package version


author: Oleksiy Shchukin <oshchukin@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 6.3.0-1
changelog:
- DEF-19613: [PD] Fix reporting of the Proactive Defense package version
- DEF-19690: Add i360.so module for ea-php80, ea-php81


author:
Alexey Berezhok <aberezhok@cloudlinux.com>, Eugene Vodilov <evodilov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.4.1-1

changelog:
- DEF-19678: Implement performance fixing i360_rdtsc -> clock_gettime invocation
- DEF-19891: PD PHP queue optimization
- DEF-20040: Fix PHP 8.x segfault on DirectAdmin
- DEF-19977: Add i360.so module for alt-php81 (& plesk-php81) for Debian/Ubuntu


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.4.3-1
changelog:
- DEF-15106: multiPHP configuration for DA native support
- DEF-20481: handle /proc/self/environ is absent/unaccessible


changelog: - DEF-17621: Optimize work of proactive defence. Stage 2
author:
Alexey Berezhok <aberezhok@cloudlinux.com>, Eugene Vodilov <evodilov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 7.0.0-1


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 7.1.0-1
changelog:
- DEF-21147: Fix version of the rules in i360_report_only events
- DEF-20926: Bugfix for "buf is too small" sporadic db error


author: Eugene Vodilov <evodilov@cloudlinux.com> 7.5.0-1
changelog:
- DEF-22684: Cross-server Auto-Immunity (Stage II)
- DEF-23380: Disable HMAC verification for i360 messages


author: Eugene Vodilov <evodilov@cloudlinux.com> 7.6.0-2
changelog:
- DEF-23621: Do not hook into zend_execute_ex() when JIT is enabled
- DEF-23709: Collect statistics on communication between PHP daemon and i360.so
- DEF-19739: Migrate from "queue" to "queue_sig" in PD reporting to the Correlation


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.6.1-1
changelog:
- DEF-24118: provide correct proto* files for i360.so where packet statistics is marked as required
- DEF-24243: enable statistics when there were rejected messages during the last request


author: Alexey Berezhok <aberezhok@cloudlinux.com> 7.7.0-1
changelog:
- DEF-23971: Remove PCRE_ANCHORED flag for pcre_exec in Proactive Defense
- DEF-23919: remove queue from i360.so
- DEF-24418 calculate message drop on php-daemon side
- DEF-24381 Revert DEF-23971 and send queue_sig as part of proactive defense messages


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.7.1-1
changelog:
- DEF-24716 send timings and counters only when they fully enabled
- DEF-24716 always send stats data to php-daemon (except when i360 is deactivated)


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.7.3-1
changelog:
- DEF-25148: read config entries in MINIT before checking them
- DEF-25200: increase api limits for perf stats


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 7.8.0-1
changelog:
- DEF-24048: Implement segfault handling in i360.so
- DEF-24284: add backtrace reporting on segfault
- DEF-24605: Remove EF0_HASH from environment list
- DEF-24781: optimize hot functions (i360_free_func_params_new, map_hash, brp_map_hash)
- DEF-24949: initialize RINIT counters only once


author: Vladimir Pavlyuk <vpavlyuk@cloudlinux.com> 7.10.0-1
changelog:
- DEF-25770 Clean up configs related to PHP 5.4 and PHP 5.5
- DEF-25572 Collect monitoring data from i360 on mshutdown when conditions are met
- DEF-25427 Track connection statistics on PHP daemon side
- DEF-25427 Remove old communication statistics
- DEF-25559: Replace I360_PD_DATABASE_BLOCK_BIT | I360_PD_DATABASE_BLOCK_EXCLUDE_BIT with I360_PD_DATABASE_BLOCK | I360_PD_DATABASE_BLOCK_EXCLUDE in I360_PD_CONDITION_INCLUDES, restore more optimized way of moving bits from conditions to matching bitmap
- DEF-25431: replace I360_PD_DATABASE_WRITE_LOG with I360_PD_DATABASE_WRITE_LOG_BIT in i360_pd_database_func_foreach
- DEF-25273: Implement Greylisted EF0 hashes support
- DEF-25212: copy URL to absolute path field if no absolute path present
- DEF-25277: fix script filename if it is a URL, include URL schema to environment variables in case it is present


author: Vladimir Pavlyuk <vpavlyuk@cloudlinux.com> 7.10.0-1
changelog:
- DEF-25572 Collect monitoring data from i360 on mshutdown when conditions are met
- DEF-25427 Track connection statistics on PHP daemon side
- DEF-25427 Remove old communication statistics
- DEF-25559: Replace I360_PD_DATABASE_BLOCK_BIT | I360_PD_DATABASE_BLOCK_EXCLUDE_BIT with I360_PD_DATABASE_BLOCK | I360_PD_DATABASE_BLOCK_EXCLUDE in I360_PD_CONDITION_INCLUDES, restore more optimized way of moving bits from conditions to matching bitmap
- DEF-25431: replace I360_PD_DATABASE_WRITE_LOG with I360_PD_DATABASE_WRITE_LOG_BIT in i360_pd_database_func_foreach
- DEF-25273: Implement Greylisted EF0 hashes support
- DEF-25212: copy URL to absolute path field if no absolute path present
- DEF-25277: fix script filename if it is a URL, include URL schema to environment variables in case it is present


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.11.0-1
changelog:
- DEF-25578 Keep jit_compatible_mode parameter during upgrades (debian)
- DEF-25851 Resolve security vulnerabilities in go projects
- DEF-25196: Optimize string functions in i360.so
- DEF-25195: Delete unused/obsolete functions
- DEF-25601: Move jit_compatibility_mode to a separate config option to immunify360.conf; move reading yaml configs to MINIT
- DEF-25866: Support event filtering in HDB / i360.so. Add SKIPLOG hash flag, bit 16 - 0x10000 hex, 1 dec


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.11.3-1
changelog:
- DEF-26503: Fix: i360_free_global_copy is not called before reopening db with i360_make_global_copy thus leaking resources
- DEF-26385: i360.so running by PHP-FPM can't read user config


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.12.0-2
changelog:
- DEF-26902: add release rendering in spec files
- DEF-26676 Use Correlation UI for i360-php-logger configuration file management
- DEF-26496: Fix: not closing malware directory FD before reopening
- DEF-25494: Increase RAW_POST_DATA to 1024 for blocked events
- DEF-25573: Watch for alt-php8[12] package changes on CL systems
- DEF-25865: Send suspicious data for malware scanner during PHP script execution
- DEF-26017: Release PD configuration sripts as part of i360-php package
- DEF-26039: i360-storage-new should use imunify360-venv python
- DEF-26121: Fitler temporary wp event logging on the stream hook stage instead of logging stage
- DEF-26268: Cache configuration files for 1 minute
- DEF-26363: Trigger cagefs remount only after configuration files are installed when enabled
- DEF-26397: Reset dbgcounters on a new request
- DEF-26497: Develop a script for module.ini gradual rollout for PD


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.12.1-1
changelog:
- DEF-27174: mark scan hashes log_only when malware is not found
- DEF-27027: watch php82 package changes
- DEF-26886: add php8.3 support


author: Egor Zyryanov <ezyryanov@cloudlinux.com> 7.1.0-2
changelog:
- DEF-20112: Fix gcc -Werror for i360-storage build
- DEF-21478: Fix gcc warnings for utility dict_util_string


author: Evgenii Vodilov <evodilov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 7.2.0-1
changelog:
- DEF-19730: Block malware drops based on the execution flow hashing
- DEF-21741: Bump LimitNOFILE to 65536 for php-daemon service


author: Egor Zyryanov <ezyryanov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 7.2.0-3
changelog:
- DEF-21604: Fix gcc warnings during php_i360 unit tests
- DEF-21792: php-daemon: add optional /var/log/imunify360/php-daemon_db.log


author: Mikhail Faraponov <mfaraponov@cloudlinux.com> 7.2.0-4
changelog:
- DEF-19455: move php-logger to cgroups slice
- DEF-21925: Calculate EF hash on Blamer's file open for write operation
- DEF-21862: Extend performance stats for PD 7.x
- DEF-22439: missing: debuginfo since PD 7.1.1-1.1


author: Egor Zyryanov <ezyryanov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 7.3.1-2
changelog:
- DEF-19679: HMAC procedure introduced
- DEF-22733: Fix JIT conflict bug
- DEF-22788: Auto-immunity autorules segfault fix


author: Egor Zyryanov <ezyryanov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 7.4.0-1
changelog:
- DEF-22791: Generating pre-built key for hmac
- DEF-22928: Fix "/usr/local/php80 i360.so is stuck provokes segfault"


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.9.0-1
changelog:
- DEF-24556: send queue data only once
- DEF-24884: refactor code in counters
- DEF-24881: reformat the code of i360.so
- DEF-24945: Add human-readable macros for constants and bit operations
- DEF-25032: add script filename and current script filename to segfault reporting, compile segfault handling for php versions higher than 8
- DEF-25431: replace I360_PD_DATABASE_WRITE_LOG with I360_PD_DATABASE_WRITE_LOG_BIT in i360_pd_database_func_foreach


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 7.12.1-1
changelog:
- DEF-27174: mark scan hashes log_only when malware is not found
- DEF-27027: watch php82 package changes


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.1.1-1
changelog:
- DEF-27665: install i360.so ad hoc when a new version of php is installed on cloudways, remove .cpanel.multiphp dir


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.1.2-1
changelog:
- DEF-27197: set jit_compatible_mode to null when not specified explicitly 
- DEF-28212: do not fail when i360-merged config is absent
- DEF-28237: validate license against alternative pubkey
- DEF-28279: do not block recognized malware when DISABLED


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.1.5-1
changelog:
- DEF-28711: properly initialize connection tracker changes
- DEF-28286: add functionality to block exit/die
- DEF-28558: fix incorrect pd_duration in mode: DISABLED


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.2.0-1
changelog:
- DEF-29395: Don't block function if mode is DISABLED
- DEF-29391: use apm info to detect cloudways
- DEF-28063: Add ability to block URL list in header function within autorules


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.2.3-1
changelog:
- DEF-29953: Identify the chain of includes where the event happened
- DEF-29449: Unify code working with PD modes
- DEF-29744: Properly handle PHP opcache optimization when enabled
- DEF-30198: Do not log events generated by whitelisted scripts
- DEF-30442: (debian) stop php-daemon on i360 uninstall
- DEF-30469: Update opcache mask to avoid rare segfaults for php7.2


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.3.0-1
changelog:
- DEF-30822: enable segfault reporing by default
- DEF-30987: move 'extension=i360.ini' line from php.ini to php.d/i360.ini
- DEF-30982: fix i360.ini paths on debian/ubuntu
- DEF-31181: Add php8.4 support. Enhance php8.3 support on Ubuntu24. Release PD for ea-php8.X for rhel >= 7.


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.3.2-1
changelog:
- DEF-31786: fix errors in i360-pkg-watcher reported by sentry
- DEF-31793: use noop mode in i360-pkg-watcher


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.4.0-1
changelog:
- DEF-29731: use imunify-common module for api operations
- DEF-31896: add script uri, script filename and servername to segfault messages, refactor failure messaging
- DEF-32116: report i360 events only, increase backtrace depth
- DEF-31544: add memory limit checks, log to php-daemon when php memory is exhausted
- DEF-32250: do not create extra files in dangerlist directory
- DEF-32181: fix monitoring stats memory leak


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.4.1-1
changelog:
- DEF-32609: update go version to 1.24.1
- DEF-32882: monitor i360.so segfaults only in ossec trigger
- DEF-32882: use '*' as a dummy if function name is unavailable in backtrace
- DEF-32882: check e->name before using it in hash_queue_calc to avoid segfault
- DEF-32959: cover missing PHP versions for certain platforms
- DEF-33406: do not execute external commands without timeout
- DEF-33406: use systemd watchdog to track php-daemon health


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.4.3-1
changelog:
- DEF-32880: use ef1 hashes when jit_compatible_mode is on
- DEF-34035: clear outdated events on php-daemon startup


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.4.4-1
changelog:
- DEF-34424: add i360.so to php.ini for alt-phps to enable i360 on cagefs
- DEF-34708: use all imunify360-agent's sentry tags


author: Siarhei Pol <spol@cloudlinux.com> 8.4.5-1
changelog:
- DEF-35040: reduce rules compilation in i360-storage-new.py on cloudways
- DEF-34985: replace int with size_t in arguments of i360_add_func_param_value_add_new
- DEF-34749: rate limit monStats aggregator errors
- DEF-34748: rate limit perfStats aggregator errors


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.5.0-1
changelog:
- DEF-35813: Release rules.yaml as part of Proactive Defence package
- DEF-36251: Do not tamper with OPcache optimization level
- DEF-35677: Optimize installation/removal of i360 in install-clean.sh
- DEF-35314: Fix APPLICATION_ID functionality for per-application configuration and whitelist loading


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.5.1-2
changelog:
- DEF-29731: rely on gw directory instead of custom flag at install time
- DEF-29731: reenable file gateway Correlation API communication when present
- DEF-35942: enable i360.so in php.d/i360.ini if 'cagefs_disabled=on' is set in cagefs.ini
- DEF-36588: Removed some manual rules to replace with php_immunity
- DEF-35459: Switch EF1 hash processing to Block mode


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> 8.5.2-1
changelog:
- DEF-37610: collect dbgcounters without rule counters when debug stats are activated
- DEF-37501: use non-privileged config in logger and daemon
- DEF-37610: fixed STAT_WHOLE_BLAMER and STAT_WHOLE_RINIT counters
- DEF-38065: enable iter_proc_self_environ call when environ is NULL on all phps
- DEF-37465: add alt-php85 support


author: Arsenii Pastushenko <apastushenko@cloudlinux.com> 8.5.3-3
changelog:
- DEF-39595: add /opt/imunify360/lib and /opt/imunify360/proactive to cagefs.mp
- DEF-39147: handle CSI volumes correctly
- DEF-37920: jit_compatible_mode is enabled by default if not exist in configs or it equals null
- DEF-38490: call php_settings -u on new alt-php package installations only
- DEF-38822: fix dangling pointers in log_result_i360
- DEF-38394: add support for ea-phps on el10, add ea-php85 support
- DEF-39894: replace php_settings with php_handler --reread to update php configs on plesk
- DEF-39894: reorganize scriptlet calls


author: Siarhei Pol <spol@cloudlinux.com> 8.5.4-1
changelog:
- DEF-39893: reorganize rules/ directory (default/current) and add rule 131316 to current rules
- DEF-40403: fix native_da.hook failing to install i360.so for custombuild PHP 8.5
- DEF-38287: remove imunify360-merged.config from CageFS visibility


author: Siarhei Pol <spol@cloudlinux.com> 8.5.5-4
changelog:
- DEF-40874: clean up signatures and rules on package purge
- DEF-39897: build imunify360-php-i360 for Ubuntu 26.04
- DEF-39514: remove jit_compatible_mode config migration from installation scripts
- DEF-38676: add support zlib in 131315 and 131316 rules


author: Alexey Berezhok <aberezhok@cloudlinux.com> 0.6-1
changelog:
- ICPD-18: Hide i360 extension from PHP Selector
- ICPD-48: i360-storage should work with pattern files with \n and \r\n on .bin file creation
- ICPD-71: installation issue: /var/softtmp!/usr/share/i360-php-opts/ is NOT a directory or does NOT exist
- ICPD-63: Blamer v0.1


author: Alexey Berezhok <aberezhok@cloudlinux.com> 3.9.0-1.5
changelog:
- ICPD-22: Errors about removed i360.so extension and error with /opt/alt/php56/etc/php.d/zzzzzzz-pecl.ini


author: Alexey Berezhok <aberezhok@cloudlinux.com> 0.10-1
changelog:
- Prepare to global testing
- ICPD-52: Create mechanism to remove False Positives from proactive defence
- Added new set of unit tests for i360


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.0.0-1.9
changelog:
- DEF-7037: Disable proactive defence support for EA3
- DEF-6876: Add ability to enable and disable blamer on UID level
- DEF-6964: Move blamer option to the imunify.config
- ICPD-218: Add behaviour: option: null should be parsed as no option at all in imunify config
- ICPD-217,ICPD-52: Create mechanism to remove False Positives from proactive defence
- ICPD-223: Fix non-critical trouble on php_i360 install


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.1.0-1.3
changelog:
- Added false positive filtering
- ICPD-112: Add new keys(log only)
- ICPD-49: Write to web server's error log before killing scripts


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.1.0-1.6
changelog:
- ICPD-279: Add i360.so for alt-phpXX for Plesk to the file /opt/alt/phpXX/link/conf/default.ini
- Def-7732: i360 already loaded error


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.1.0-1.16
changelog:
- ICPD-309: Speed up compiling of regexpressions on startup. Precompile only needed regular expressions


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.6.0-1.7
changelog:
- ICPD-668: Add proactive defence configuration per directory
- ICPD-642: Particular function execution skipping
- ICPD-692: Rule with specified script_ext: .ico applied to .php file
- ICPD-688: Add support of list black listed files. Block include(etc) when it try to include file from list
- ICPD-675: After removing imunify360, *i360* php module remain
- ICPD-734: Add new rules created by analitics(including ico ignoring, some danger url including ignoring instead of killing)


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.7.0-1.9
changelog:
- DEF-10984: Check origins of the symlinks (via fstat) to prevent baypassing of include protection
- ICPD-775: Extend script_ext logic
- ICPD-838: Move proactive socket to /opt - proactive plugin


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.8.0-1.7
changelog:
- ICPD-829: Extend reporting of the configuration from running PD
- ICPD-837: Add possiblity for rules to refer to separate lists of files
- ICPD-851: i360.so PHP extension breaking PHP with a RAM issue
- DEF-11716: Adapt current algorithm of exclude list in PD to the new specifications
- DEF-11952: I360.so is absent for php7.4 on Ubuntu ( plesk)
- DEF-11831: Correct multiple IPs reporting


author: Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 4.10.0-1.10
changelog:
- DEF-12053: Recompile autorules.yaml on proactive/php update
- DEF-12617: Make separate rule for exclude list events and make it as log rule
- DEF-11957: Implement FP lists linked to rules only
- DEF-11951: Add lsphp support for generic panel
- DEF-12992: Add flock for can be executed only one instance i360-storage-mkcustom at the same time
- Removed duplicating FP rules
- DEFA2959 thewordpressclub[.]org infected nulled themes/plugins 10039
- LOG->BLOCK 131370->10035 131371->10036 131372->10037 131374->10038, removed 131373
- Fixed 33 rule and moved to 131335 for re-test2
- Fixed 33 rule and moved to 131335 for re-test
- Removed 131336 rule as useless
- Removed 131353 rule as useless
- Removed 131378, reworked 10024-10029 rules patterns
- SMW-SA-15253-php.tool.goto-1 simplified 10018 rule, removed 10020,10021
- Added 10034 SMW-SA-15253-php.tool.goto-1 thms/plgns block install
- Added 131377 and 131378 log rules - fakeplugin,bckdr
- wpvcd added 10033 rule and imroved 10010
- Improved 10025 regex
- Added LOG test rules 131375, 131376


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.10.0-1.12
changelog:
- DEF-13321: Exclude index.php only for Standalone malware execution (10001 4.9.6 and 11001 4.10.1+)
- DEF-13198: Make separate rule for blocking standalone malware


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.2.0-1.2
changelog:
- Cleanup ponters for preventing garbage in phpinfo after disabling of i360
- Added "builded for" for phpinfo


author:
Andrew Rassokhin <arassokhin@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 4.2.0-1.19

changelog:
- Fix blamer detection rules and replace \d to [0-9]
- ICPD-350: Ability to bypass FP check for specific rule
- ICPD-349: Create buffer filtering mechanism for rules
- ICPD-348: Blamer data research: Method 7 search malicious scripts by UID and GID
- ICPD-355: Add link to libcurl library for i360.so
- ICPD-356: Make connect in the i360.so with timeout. Because if agent is busy i360 can stop PHP until agent accept the connection
- ICPD-305: webmail sending and login problems with Imunify 4.0.3-1
- ICPD-368: Remove fopen from writeloggers group of rules.yaml
- ICPD-369: Filter blamer attempts if write not to files
- ICPD-363: Make the concept of sending messages from PD to Agent via the separate daemon.
- ICPD-372: Add extension check key into rules.yaml
- ICPD-366: Rebuild PD rules from 4.1.0 to 4.2.0
- ICPD-371: Fix i360.so installation error on Ubuntu for alt-php
- ICPD-375: Add ability to switch proctive defense modes
- ICPD-409: Create email sending logging rules for PD
- ICPD-419: Proactive Defence freezes PHP if Imunify360 config file is broken
- ICPD-418: Move extension=i360.so from zzzzzzz-pecl.ini back to alt-phpXX php.ini


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 4.2.1-1.2
changelog:
- ICPD-357: Add rules groups to the rules.yaml
- ICPD-374: Imply `cagefsctl --rebuild-alt-php-ini' on update


author: Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 4.2.2-1.4
changelog:
- ICPD-459: Increase in Semaphore usage after recent i360.so update.
- ICPD-483: Change algorithm of blamers reducer. We shouldn't decrease counter of event if this message not appears during one hour
- ICPD-486: Reducer is killing PHP-FPM pool processes


author: Eugene Vodilov Alexey Berezhok <aberezhok@cloudlinux.com> 4.2.5-1.1
changelog:
- ICPD-489: Blamer file get filtered by csf
- ICPD-496: Improve hash calculation for event ID in reducer algorithm


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 4.3.0-1.1
changelog:
- ICPD-590: Add i360.so module for ea-phph73
- ICPD-396: Copy values of SERVER array on php script RINIT stage for preventing changing during script execution
- ICPD-562: we have proactive list returns eval() code. Path shouldnt contain eval


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.4.0-1.1
changelog:
- ICPD-396: Copy values of SERVER array on php script RINIT stage for preventing changing during script execution
- ICPD-562: we have proactive list returns eval() code. Path shouldnt contain eval


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 4.4.0-1.5
changelog:
- ICPD-692: Rule with specified script_ext: .ico applied to .php file
- ICPD-675: After removing imunify360, *i360* php module remain
- ICPD-708: Proactive Defense Issues


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.5.0-1.11
changelog:
- ICPD-766: Remove -p /bin/bash -x from the spec file for disabling path execution output
- ICPD-765: Add stat wrapper for comand chmod & touch for checking that file or directory exists for avoid error output


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.7.0-1.16
changelog:
- DEF-10984: Check origins of the symlinks (via fstat) to prevent baypassing of include protection
- ICPD-775: Extend script_ext logic
- ICPD-838: Move proactive socket to /opt - proactive plugin
- Enable new blamer
- ICPD-848: proactive defense stops working after alt-php reinstall
- ICPD-851: i360.so PHP extension breaking PHP with a RAM issue
- Update rules


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 4.7.0-1.18
changelog:
- Def-11831 Correct multiple IPs reporting
- Updated rules DEFA-2499
- DEF-11907: test_proactive failed (RPM-tests)


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.9.0-1.7
changelog:
- DEF-13321: Exclude index.php only for Standalone malware execution (10001 4.9.6 and 11001 4.10.1+)


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.1.0-1.1
changelog:
- DEF-13410: i360 Module is missing for EA_PHP74
- DEF-13323: Add whitelist support for rule 10001 and 11001 - standalone malware execution. Proactive internal list


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.2.0-1.6
changelog:
- DEF-13485: i360.so debian10 build is broken
- DEF-13793: Add qhash to the blamer message, because of php-daemon relates on this field
- DEF-13905: Build new 5.2 PD rules package


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.2.0-1.5
changelog:
- DEF-13485: i360.so debian10 build is broken
- DEF-13793: Add qhash to the blamer message, because of php-daemon relates on this field


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.3.0-1.9
changelog:
- DEF-13655: Check and add output messages for command i360-storage-mkcustom, its messages will be logged. Check message on segfault
- DEF-13842: Add support in proactive defence finding of bin file based on version PD
- DEF-13843: Add support of i360-storage version of PD
- DEF-13905: Build new 5.2 PD rules package


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.4.0-1.11
changelog:
- DEF-14158: Add new rules for core file protection
- DEF-13729: Add WordPress Core files protection with Proactive Defence
- DEF-13742: Check how php represent relative path in case in descripton
- DEF-14285: Make autoupdates excludelist on build of package
- DEF-14123: Hook move_uploaded_files in PD
- DEF-14468: WP Core protection - decrease rules FP rate


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.4.0-1.15
changelog:
- DEF-14888: Change in ubuntu's scriptlets grep to awk because grep affect the result of the script, in case of grep false, scriptlet returns 1


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.6.0-1.3
changelog:
- DEF-14901: Add Server API field to proactive defence reporting, for the gathering of configured PHP mode
- DEF-14939: Add separation of function names(fopen(r) and file_get_contents) on php_imunify events
- DEF-14912: Research integration of PD into php8


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.6.0-1.4
changelog:
- DEF-15335: Add whitelist fp possibility for rule 135000 (kill non-wp core files direct execution)
- DEF-14914: Restore support in blamer's events exec and system functions


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.7.0-1.2
changelog:
- DEF-15628: Proactive defence does not work on CL6 + cPanel + Litespeed configuration(persistent fix)
- DEF-15885: Proactive defence does not work on Centos8 + cPanel + modsec3 configuration
- DEF-15770: Additional exclude_files_list for WP core files protection
- DEF-15749: Add Nightly/Beta WP files to WP core protection exclude list


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.8.0-1.1
changelog:
- DEF-15255: [Proactive] Use PERMISSIONS.user_override_proactive_defense
- DEF-15844: [C] Switch to the new imunify360 config path (PD)
- DEF-16102: Skip 0-size files include and some other functions


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.8.0-1.3
changelog:
- DEF-15255: [Proactive] Use PERMISSIONS.user_override_proactive_defense
- DEF-15844: [C] Switch to the new imunify360 config path (PD)
- DEF-16102: Skip 0-size files include and some other functions
- DEF-16705: Fix DA trouble when native PHP is link to our alt-php our da.hook just remove i360.so


author: Alexey Berezhok <aberezhok@cloudlinux.com> 6.0.0-1.1
changelog:
- DEF-17237: Optimize execution flow 
- DEF-17234: Make optimization of check_chain. Use one char instead regexp 
- DEF-17399: Save data sent by balmer in the internal buffer. Change only dynamic data during request


author: Eugene Vodilov <evodilov@cloudlinux.com> 6.0.0-1.12
changelog:
- DEF-16413: Fix trouble with libffi 3.0.5 on CL6+cagefs+lsapi
- DEF-16416: Fix trouble that we not always started earlier than ioncube. Hooking in function_table is not enought for mode ioncube - --obfuscate all


author: Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 6.0.0-1.15
changelog:
- DEF-18300: i360.so map_deinit_ segfault
- DEF-18156: Number of records in proactive_queue decreased, it is not expected (Part 2)


author: Alexey Berezhok <aberezhok@cloudlinux.com> 6.0.0-1.3
changelog:
- DEF-17825: Add cleaning of static parameters before i360_eval_compile_string_hook for php less than 8
- Renew signatures


author: Alexey Berezhok <aberezhok@cloudlinux.com> 6.1.0-1.2
changelog:
- DEF-17103: Collect performance data in PD
- DEF-18067: Make for reverse_ordered_list addition all substrings should be shortened in one shortest


author: Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 6.1.0-1.6
changelog:
- DEF-18300: i360.so map_deinit_ segfault
- DEF-18156: Number of records in proactive_queue decreased, it is not expected
- DEF-17838: Make php_stream independent injection of PD blamer functions


author:
Husein Haidarov <hhaidarov@cloudlinux.com >, Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 6.2.0-1.1

changelog:
- DEF-18077: Add functional of file_op_name, file_op_content
- DEF-18080: Rewrite rules for usage of file_op_name, file_op_content instead of check_buf
- DEF-18300: i360.so map_deinit_ segfault
- DEF-18156: Number of records in proactive_queue decreased, it is not expected


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.2.0-1.3
changelog:
- DEF-18517: Fix getpwuid(getuid()) returns NULL
- DEF-17970: More i360 details for agent's tests php_info.php


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.2.0-1.4
changelog:
- DEF-17748: Proactive Defense does not work on PHP8/Plesk/Ubuntu
- DEF-18481: Add support php 8.1 for PD
- DEF-18607: Fix race condition segfault on rules upgrade


author:
Husein Haidarov <hhaidarov@cloudlinux.com>, Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 6.2.0-1.1

changelog:
- DEF-18077: Add functional of file_op_name, file_op_content
- DEF-18080: Rewrite rules for usage of file_op_name, file_op_content instead of check_buf
- DEF-18300: i360.so map_deinit_ segfault
- DEF-18156: Number of records in proactive_queue decreased, it is not expected


author: Husein Haidarov <hhaidarov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.2.0-1.6
changelog:
- DEF-18653: only send perf stats when rules found
- DEF-18812: Add i360.so to ea-phpXY for Ubuntu 20


author:
Alexey Berezhok <aberezhok@cloudlinux.com>, Eugene Vodilov <evodilov@cloudlinux.com>, Oleksiy Shchukin <oshchukin@cloudlinux.com> 6.4.2-1

changelog:
- DEF-19678: Implement performance fixing i360_rdtsc -> clock_gettime invocation
- DEF-19891: PD PHP queue optimization
- DEF-20040: Fix PHP 8.x segfault on DirectAdmin
- DEF-19977: Add i360.so module for alt-php81 (& plesk-php81) for Debian/Ubuntu
- DEF-20391: The fix for excessive blamer message parsing errors
- DEF-20254: Bump imunify360-php-daemon version


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.6.0-3
changelog:
- ICPD-668: Add proactive defence configuration per directory
- ICPD-642: Particular function execution skipping
- ICPD-692: Rule with specified script_ext: .ico applied to .php file
- ICPD-734: Add new rules created by analitics(including ico ignoring, some danger url including ignoring instead of killing)


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.7.0-7
changelog:
- DEF-10984 Check origins of the symlinks (via fstat) to prevent baypassing of include protection
- ICPD-775: Extend script_ext logic


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.8.0-7
changelog:
- ICPD-829: Extend reporting of the configuration from running PD
- ICPD-837: Add possiblity for rules to refer to separate lists of files


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.8.0-10
changelog:
- Added 10016 rule to prevent /tmp/mn drop
- Added curl log rule 131365
- Added 131353-64 LOG rules DEFA-2655


author: Alexey Berezhok <aberezhok@cloudlinux.com> 4.9.0-4
changelog:
- DEF-11927: Forbid standalone malware execution
- DEF-12617: Make separate rule for exclude list events and make it as log rule
- Update rules


author: Eugene Vodilov <evodilov@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 4.10.0-6
changelog:
- DEF-12053: Recompile autorules.yaml on proactive/php update
- DEF-12617: Make separate rule for exclude list events and make it as log rule
- Removed duplicating FP rules
- DEFA2959 thewordpressclub[.]org infected nulled themes/plugins 10039
- LOG->BLOCK 131370->10035 131371->10036 131372->10037 131374->10038, removed 131373
- Fixed 33 rule and moved to 131335 for re-test2
- Fixed 33 rule and moved to 131335 for re-test
- Removed 131336 rule as useless
- Removed 131353 rule as useless
- Removed 131378, reworked 10024-10029 rules patterns
- SMW-SA-15253-php.tool.goto-1 simplified 10018 rule, removed 10020,10021
- Added 10034 SMW-SA-15253-php.tool.goto-1 thms/plgns block install
- Added 131377 and 131378 log rules - fakeplugin,bckdr
- wpvcd added 10033 rule and imroved 10010
- Improved 10025 regex
- Added LOG test rules 131375, 131376


author: Andrew Rassokhin <arassokhin@cloudlinux.com>, Alexey Berezhok <aberezhok@cloudlinux.com> 4.2.0-7
changelog:
- Fix blamer detection rules and replace \d to [0-9]
- ICPD-350: Ability to bypass FP check for specific rule
- ICPD-349: Create buffer filtering mechanism for rules
- ICPD-348: Blamer data research: Method 7 search malicious scripts by UID and GID
- ICPD-355: Add link to libcurl library for i360.so
- ICPD-356: Make connect in the i360.so with timeout. Because if agent is busy i360 can stop PHP until agent accept the connection
- ICPD-305: webmail sending and login problems with Imunify 4.0.3-1
- ICPD-368: Remove fopen from writeloggers group of rules.yaml
- ICPD-369: Filter blamer attempts if write not to files
- ICPD-363: Make the concept of sending messages from PD to Agent via the separate daemon.
- ICPD-372: Add extension check key into rules.yaml
- ICPD-366: Rebuild PD rules from 4.1.0 to 4.2.0


author: Eugene Vodilov <evodilov@cloudlinux.com> 4.2.2-3
changelog:
- ICPD-459: Increase in Semaphore usage after recent i360.so update
- ICPD-483: Change algorithm of blamers reducer. We shouldn't decrease counter of event if this message not appears during one hour


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Oleksiy Shchukini <oshchukin@cloudlinux.com> 5.3.0-6
changelog:
- DEF-13655: Check and add output messages for command i360-storage-mkcustom, its messages will be logged. Check message on segfault
- DEF-13842: Add support in proactive defence finding of bin file based on version PD
- DEF-13843: Add support of i360-storage version of PD


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.4.0-7
changelog:
- DEF-14158: Add new rules for core file protection
- DEF-13729: Add WordPress Core files protection with Proactive Defence
- DEF-13742: Check how php represent relative path in case in descripton
- DEF-14285: Make autoupdates excludelist on build of package
- DEF-14468: WP Core protection - decrease rules FP rate


author: Alexey Berezhok <aberezhok@cloudlinux.com> 5.6.0-3
changelog:
- DEF-14901: Add Server API field to proactive defence reporting, for the gathering of configured PHP mode
- DEF-14939: Add separation of function names(fopen(r) and file_get_contents) on php_imunify events
- DEF-15335: Add whitelist fp possibility for rule 135000 (kill non-wp core files direct execution)
- DEF-14914: Restore support in blamer's events exec and system functions
- DEF-14912: Research integration of PD into php8


author: Husein Haidarov <hhaidarov@cloudlinux.com > 6.2.0-2
changelog:
- DEF-18077: Add functional of file_op_name, file_op_content
- DEF-18080: Rewrite rules for usage of file_op_name, file_op_content instead of check_buf


author: Timur Irmatov <tirmatov@cloudlinux.com> - 1.1.0-1
changelog:
- Attempt to refactor stats collecting
- Fix sending empty payload
- Extract stats to separate package
- Move packet parsing to nflog package
- Add WebShield requests processing
- Add WebShield prefix to config's rules
- Add parsing WebShield requests
- Add WebShield request socket
- Ignore localhost IPs from being collected
- Fix empty build version


author: Timur Irmatov <tirmatov@cloudlinux.com> - 1.2.0-1
changelog:
- Add parsing for /proc/net/nf_conntrack
- Add parsing for /proc/net/tcp(6)
- Add sending server stats to Correlation server
- Add parsing for /proc/meminfo
- Add parsing for /proc/loadavg
- Do not fail if nfnl_rcvbufsiz call fails
- Add parsing for /proc/meminfo
- Add parsing for /proc/loadavg


author: Anton Osatiuk <aosatiuk@cloudlinux.com> - 2.1.0-1
changelog:
- Change incidident's message format
- Change submitting incidents method to UNIFIED_ACCESS_LOG
- Update florianl/go-nflog to the latest version
- Drop cnflog package
- Extend gonflog to deliver UID/GID of the sender process
- Fix panic upon receiving nil UID and GID


author: Anton Osatiuk <aosatiuk@cloudlinux.com> - 3.1.2-1
changelog:
- Use commit hash in gerrit builds
- Update license
- Add README.md
- Avoid logging if /proc/net/nf_conntrack does not exist


author: Nurzhan Bazhirov <nbazhirov@cloudlinux.com> - 3.2.1-5
changelog:
- DEF-21421: use /var/log/imunify360/imunify360-unified-access-logger/ as log destination
- DEF-19461: Added wall time reporting to cgroups accounting wrapper
- DEF-19469: Added daily cron job for self-update
- DEF-19458: cgroups accounting wrapper: implement cgroups support
- DEF-19459: cgroups accounting wrapper: create basic skeleton. Fixed stdout/stderr instability
- DEF-21298: do not send cgroup deleted error to sentry


author: Pavel Zaikin <pzaikin@cloudlinux.com> - 3.2.8-1
changelog:
- DEF-25281 move incidentSubmitPeriod to comand line args
- DEF-24793: Do not error on empty report
- DEF-24792: Ignore corrupted fields when parsing meminfo


author: Amit Levy <alevy@cloudlinux.com> - 3.4.0-1
changelog:
- DEF-31058: fix(ci) unit tests UNSTABLE should be FAILED
- DEF-31058: add support for cgroups v2
- DEF-31058: run golangci-lint


author: Amit Levy <alevy@cloudlinux.com> - 3.4.2-1
changelog:
- DEF-32102: ignore cgroup.controller file not found errors
- DEF-32094: ignore cgroup not exist errors


author: Amit Levy <alevy@cloudlinux.com> - 3.5.0-1
changelog:
- DEF-29735: add filebased gateway for correlation server
- DEF-32809: fix memory data is shown in bytes should by megabytes
- DEF-32871: fix main slices like Imunify.slice are not reported
- DEF-32241: add logs for easier debugging rpm tests


author: Amit Levy <alevy@cloudlinux.com> - 3.5.1-1
changelog:
- DEF-32816: fix cpu stats not collected if controllers is off
- DEF-32479: fix ual not synced with systemd


author: Amit Levy <alevy@cloudlinux.com> - 3.5.4-1
changelog:
- DEF-33715: fix file not found for v1
- DEF-33922: fix cleaup nested dirs
- DEF-33922: fix no space when creating metric files
- DEF-33881: ignore "unknown" parsing errors


author: Aidyn Torgayev <atorgayev@cloudlinux.com> - 3.6.4-1
changelog:
- DEF-35241: do not send error if ipv6 is disabled
 * Thu Jul 10 2025 Aidyn Torgayev <atorgayev@cloudlinux.com> - 3.6.3-1
- DEF-35000: add profiling tools


author: Eugene Vodilov <evodilov@cloudlinux.com> 6.1.1-1
changelog:
- DEF-18007 Refactor NetLink usage due to problem with recv (from kernel to user-space) buffer
- DEF-18021 Cover main wafd logic with unit tests


author: Ivan Shapovalov <ishapovalov@cloudlinux.com> - 6.2.613-3
changelog:
- DEF-22522: move wafd for 'old webshield' to cgroup slice
- DEF-20224: Build imunify360-webshield-bundle for Debian 11


author: Igor Savenko <bliss@cloudlinux.com> 1.8-13
changelog:
- DEF-10236: The captcha page shows wrong IP address.
- DEF-10255: Webshield captcha shows English locale only


author: Igor Savenko <bliss@cloudlinux.com> 1.8-15
changelog:
- webshieldctl: fixed regexp in detector of running processes.
  in detection of running processes greater-or-equal is used


author: Igor Savenko <bliss@cloudlinux.com> 1.11-3
changelog:
- DEF-12305: Reorganized captcha keys
- DEF-12067: Make captcha return custom error on non-text/html requests


author: Igor Savenko <bliss@cloudlinux.com> 1.12-3
changelog:
- DEF-12689: Make webshield apply default IPv6 /64 mask to meet the i360 agent expectations
- DEF-12721: Added 'upstream' blocks to webshield configuration


author: Igor Savenko <bliss@cloudlinux.com> 1.12-10
changelog:
- DEF-11140: Make webshield remember sources, which successfully passed captcha
- DEF-13331: Added default User-Agent to use when User-Agent header is missing


author: Igor Savenko <bliss@cloudlinux.com> 1.12-13
changelog:
- DEF-13991: Make webshield send destination port with 'Host' header to the upstream
- DEF-14133: Do not modify 'X-Forwarded-For' header
- DEF-13949: make the webshield return right port in cookie


author: Igor Savenko <bliss@cloudlinux.com> 1.13-3.4
changelog:
- DEF-15125: Add 'X-Forwarded-For' header with unwrapped client IP for known proxies requests if missing


author: Igor Savenko <bliss@cloudlinux.com> 1.13-3.7
changelog:
- DEF-15251: Fixed typo in lock implementation causing temporal deadlocks
- DEF-15167: Return OK with error message on memory allocation error


author: Igor Savenko <bliss@cloudlinux.com> 1.14-6
changelog:
- DEF-13468: Fixed shared memory dumping.
- Added X-Forwarded-For header. Increased shared memory to 60M


author: Igor Savenko <bliss@cloudlinux.com> 1.14-10
changelog:
- DEF-15351: Added self-check script to amend webshield issues
- DEF-12279: Update webshield to use python 3.8


author: Igor Savenko <bliss@cloudlinux.com> 1.14-14
changelog:
- DEF-15454: Added workaround to remove outdated entries from shared memory
- DEF-15678: webshield-watchdog should use python 3.8
- DEF-15384: Change error reporting by wsshdict


author: Igor Savenko <bliss@cloudlinux.com> 1.14-15
changelog:
- DEF-15704: Changed YAML loader to 'safe_load' to silence warning
- DEF-15633: disabled stdout/stderr for watchdog script cron invocation


author: Igor Savenko <bliss@cloudlinux.com> 1.14-16
changelog:
- DEF-15616: Pass request source IP address to application server in a separate header
- DEF-15904: Replace TLSv1.1 to TLSv1.3 in webshield config
- DEF-15901: Remove proxying from webshield for watchdog script
- DEF-15826: Added more debug logging


author: Igor Savenko <bliss@cloudlinux.com> 1.14-17
changelog:
- DEF-15936: Make webshield watchdog script create flag file to inform agent that webshield is not accessible


author: Igor Savenko <bliss@cloudlinux.com> 1.15-1
changelog:
- DEF-15124: Added functionality for enabling/disabling splashscreen to webshieldctl script
- DEF-14189: Removed 'iptables' check from 'all' and 'basic' options of 'self-check' script
- DEF-15283: Remove functionality for transerring data from old wscheck.conf to new one


author: Igor Savenko <bliss@cloudlinux.com> 1.15-8
changelog:
- DEF-16223: Removed GAWK-specific varables
- DEF-16232: make DPKG retain old invisible-captcha.conf file on update


author: Igor Savenko <bliss@cloudlinux.com> 1.16-4
changelog:
- DEF-16223: Removed GAWK-specific varables
- DEF-16232: make DPKG retain old invisible-captcha.conf


author: Igor Savenko <bliss@cloudlinux.com> 1.17-4
changelog:
- DEF-16502: Added fallback in case splashcreen dictionary is full
- DEF-14293: Remove depencency to imunify360-webshield-modsecurity from the webshield
- DEF-16733: Removing duplicates from static-whitelisted config file
- DEF-16791: Changed dump file path for cron job


author: Igor Savenko <bliss@cloudlinux.com> 1.17-5
changelog:
- DEF-16852: Make 'modsecurity' package obsolete to get rid of it on update
- DEF-16985: Provide wrapper script for wsshdict cron dump/load activities


author: Igor Savenko <bliss@cloudlinux.com> 1.18-6
changelog:
- DEF-17433: Added 'modsecurity-devel' to obsoleted packages
- DEF-16811: Updated license in webshield packages


author: Igor Savenko <bliss@cloudlinux.com> 1.18-7
changelog:
- DEF-17841: Add imunify360-ipsd systemd/init dependencies to the webshield
- DEF-17765: Many webshield-watchdog processes running


author: Igor Savenko <bliss@cloudlinux.com> 1.19-10
changelog:
- DEF-19712: Raised dependency for imunify360-wafd (ipset synclists support). Tests have been added.


author: Ivan Shapovalov <ishapovalov@cloudlinux.com> 1.20.120-1
changelog:
- DEF-22522: move 'old webshield' to cgroup slice
- DEF-22600: Fixed captcha UI bug
- DEF-22521: switch to imunify360-venv, hack up nose for tests
- DEF-20224: build imunify360-webshield-bundle for Debian 11


author: Igor Savenko <bliss@cloudlinux.com> 1.20.121-1
changelog:
- DEF-23128: Excessive request to endpoint may cause very long captcha processing
- DEF-22929: Update jQuery in captcha page


author: Igor Savenko <bliss@cloudlinux.com> 1.20.122-1
changelog:
- DEF-23288: Splashscreen is shown to requests coming to ports 2082/2083 unless a valid cookie is found


author: Igor Savenko <bliss@cloudlinux.com> 1.21.0-1
changelog:
- DEF-24020: Release unified webshield
- DEF-24036: The way the splashsreen is shown can go wrong when CDNs are involved


author: Igor Savenko <bliss@cloudlinux.com> 1.22.0-1
changelog:
- DEF-24256: Loading site assets with HTTP/2 request can fail in chrome-based environment
- DEF-24228: Fixed the ways a port is added to the splashscreen redirection url


author: Igor Savenko <bliss@cloudlinux.com> 1.22.2-2
changelog:
- DEF-24916: Added connection upgrade headers
- DEF-23650: Research the percentage of requests stayed without response due to the webshield timeout
- DEF-24180: Switch webshield to alt-python311


author: Igor Savenko <bliss@cloudlinux.com> 1.23.1-1
changelog:
- DEF-25483: Make sure that whitelisted source IP addresses don't trigger splashscreen for cpanel port protecton


author: Igor Savenko <bliss@cloudlinux.com> 1.24.3-1
changelog:
- DEF-27455: In non-legacy mode for splashscreen IPs when splash is disabled module returns empty splashscreen


author: Igor Savenko <bliss@cloudlinux.com> 1.25.3-2
changelog:
- DEF-28032: wafd has memory leakage
- DEF-28060: splashscreen coookie is not checked at the wafd side


author: Igor Savenko <bliss@cloudlinux.com> 1.25.4-1
changelog:
- DEF-28072: Move XFF processing logic to nginx module side
- DEF-28056:Add caching for site additional assets for small time (10s) to wafd


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.27.0-2
changelog:
- DEF-28643: wafd logging refactoring
- DEF-28642: implement log rotation for wafd
- DEF-28640: splash fix format string
- DEF-28725: Remove cache headers duplicates
- DEF-28806: Make every splashscreen redirect unique to prevent caching
- DEF-28640: Make wafd log splashscreen shows
- DEF-28802: Enable Splashscreen for CloudFlare by default
- DEF-28761: Make sure wafd is working if webshield is stopped/disabled


author: Igor Savenko <bliss@cloudlinux.com> 1.27.0-4
changelog:
- DEF-28863: make sure wafd runs all the time
- DEF-29158: Wafd should log cases where splashscreen is expected to be shown, but wasn't shown due to present cookie.


author: Igor Savenko <bliss@cloudlinux.com> 1.28.3-1
changelog:
- DEF-30303: Fix subdomain cookie issue, which causes splashscreen loop
- DEF-29913: Do not send notifications to UAL daemon if it's disabled in config
- DEF-29694: Fix wafd logrotate postrotate script


author: Igor Savenko <bliss@cloudlinux.com> 1.30.0-1
changelog:
- DEF-29528: Send CAPTCHA messages to correlation server
- DEF-29527: Implement Captcha DoS detection in wafd


author: Igor Savenko <bliss@cloudlinux.com> 1.30.1-1
changelog:
- DEF-29913: Do not send notifications to UAL daemon if it's disabled in config
- DEF-29905: Reduce wafd memory footprint in idle mode
- DEF-30087 Prevent closing listening sockets on config reload
- DEF-30085: wafd should read token each time when it changed on the disk


author: Igor Savenko <bliss@cloudlinux.com> 1.30.2-1
changelog:
- DEF-30303: Fixed old splashscreen cookie TTL discrepancies, enabled cookie domains
- DEF-29827: Fixed accumulation issue, disabled random query parameter by default
- DEF-30366: Fix unit-tests for UAL functionality
- DEF-30435 Check enabled state on package update


author: Igor Savenko <bliss@cloudlinux.com> 1.30.2-2
changelog:
- DEF-30440: imunify360-wafd binary still active after uninstall
- DEF-30303: Changed name of cookie


author: Igor Savenko <bliss@cloudlinux.com> 1.30.3-1
changelog:
- DEF-30553: Make sure 'cf-edge-cache: no-cache' header unconditionally added to the splashscreen page


author: Igor Savenko <bliss@cloudlinux.com> 1.30.4-1
changelog:
- DEF-30678: Wafd buffer is exceeded when new splash is used with long initial URL
- Revert "DEF-30087 Prevent closing listening sockets on config reload"


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.31.3-1
changelog:
- DEF-32093 [BACKPORT] Added throttling for sentry events
- DEF-32043 [BACKPORT] Improvement in unit test TestExpectedErrorInQuery
- DEF-32043 [BACKPORT] Do not send netlink-related errors to Sentry
- DEF-31543: [BACKPORT] notify user about UAL connection loss only once


author: Igor Savenko <bliss@cloudlinux.com> 1.31.4-1
changelog:
- DEF-32418: [BACKPORT] Splashscreen variant 'B' 'connection.rtt' prevents valid UserAgents from passing splashscreen


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.32.0-1
changelog:
- DEF-31708 Set-Cookie header fixed in Apache module @BS-NOBUILD
- DEF-31679 Run switch max webserver command when max webserver environment detected


author: Miroslav Kovac <mkovac@cloudlinux.com> 1.32.2-2
changelog:
- Merge "DEF-32371: let server header to be passed from downstream"
- DEF-32371: let server header to be passed from downstream


author: Miroslav Kovac <mkovac@cloudlinux.com> 1.33.0-1
changelog:
- DEF-33776 Custom logs rotation
- DEF-33912: update coraza dependency
- DEF-33572: implement wildcard domain whitelist matching
- DEF-33695: Update coraza according to upstream
- DEF-32893: implement appSpecific rules config loading
- DEF-32895: implement handling of app specific rulsets during request processing
- DEF-33666: Remove 'none' UAL verdict from wafd


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.34.0-1
changelog:
- DEF-33694 Whitelisted domains feature fixed for Coraza mode
- DEF-32911: Version bump
- DEF-33097 Disabling webshield in Coraza mode implementation


author: Igor Savenko <bliss@cloudlinux.com> 1.34.0-3
changelog:
- DEF-34313: webshield-watchdog incorrectly reloads wafd every time it runs in CW environment
- DEF-34341: Wafd reloading after UAL state in config added
- DEF-34331: Systemd dependency for ossec-hids service has been added


author: Igor Savenko <bliss@cloudlinux.com> 1.34.4-2
changelog:
- DEF-35148: ipset_worker is not returning into pool
- DEF-35178: Wafd is constantly reloading (CloudWays)


author: Ruslan Shmelev <rshmelev@cloudlinux.com> 1.35.0-2
changelog:
- DEF-34816: Whitelist all by using * in domains_whitelist conf file
- DEF-34743: Fix unbounded memory growth in wafd with coraza
- DEF-33874: Implementation of coraza persistance storage


author: Igor Savenko <bliss@cloudlinux.com> 1.35.2-1
changelog:
- DEF-35295: Missing distinction between expiration of collection variable and of collection itself
- DEF-35398: webshield 421 Misdirected Request issue with SNI enabled in apache


author: Miroslav Kovac <mkovac@cloudlinux.com> 1.36.0-1
changelog:
- DEF-35453: support version specific rules
- DEF-34255 make a CorazaRulesChecker initialized flag reloadable
- DEF-34255 do not fail wafd if coraza failed to load config/rules
- DEF-33864 SCRIPT_FILENAME & SCRIPT_USERNAME variables implementation


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.36.1-2
changelog:
- DEF-35591: read state file before ensuring consistent state
- DEF-35104: investigation - redirect support, coraza module reference update.


author: Igor Savenko <bliss@cloudlinux.com> 1.36.2-1
changelog:
- DEF-35740: Imunify360-webshield crashes with core dumps
- DEF-35866: Added syncing with mutexes to ensureConsistentState
- DEF-35589: Make sure webshieldctl in configure stage respects current WEBSHIELD_ENABLE state


author: Igor Savenko <bliss@cloudlinux.com> 1.37.0-2
changelog:
- DEF-36343: Webshieldctl has unnecessary '$' symbol in setting defaults
- DEF-35128: Implement Coraza Logging
- DEF-35728: Implement disabling rules per domain for coraza
- DEF-35740: Imunify360-webshield crashes with core dumps
- DEF-35867: remove skip on test_modsec_rule_disabled_for_domain for coraza
- DEF-35870: wafd passing wrong format of http version
- DEF-35898: [sentry] data not convertible to netlink
- DEF-35961: [sentry] failed to convert request
- DEF-36145: wildcard whitelisting is not working correctly
- DEF-36270: In apache 'module' mode webshield port is not mapped back in splashscreen body
- DEF-35866: Added syncing with mutexes to ensureConsistentState
- DEF-35589: Make sure webshieldctl in configure stage respects current WEBSHIELD_ENABLE state


author: Vadim Kuznetsov <vkuznetsov@cloudlinux.com> 1.37.1-1
changelog:
- DEF-36663 webshieldctl: is-active action fixed
- DEF-36363: Custom rules has been placed before coraza ruleset in modsecurity.conf


author: Miroslav Kovac <mkovac@cloudlinux.com> 1.37.3-1
changelog:
- DEF-36837: process status code if received
- DEF-36298: ids: add headless browser support to the performance framework


author: Miroslav Kovac <mkovac@cloudlinux.com> 1.38.1-1
changelog:
- DEF-37554: Change the way we handling transaction closure
- DEF-35400: Attempt to fix build for debian-based systems


author: Miroslav Kovac <mkovac@cloudlinux.com> 1.38.1-1
changelog:
- DEF-37554: Change the way we handling transaction closure
- DEF-37563: change log to debug
- DEF-37554: Per-client individual graphs added
- DEF-37554: A secondary client sending chunks has been added
- DEF-37703: create option to have pure Apache webserver in perf framework
- DEF-34947 Version bump
- DEF-37554: Performance Framework update for chunked uploads
- DEF-36358: WAFD must not apply rules for imunify360-related requests
- Support to alternative ports is added to Performance Framework
- DEF-35400: update coraza version to commit hash from main branch
- DEF-35400: Attempt to fix build for debian-based systems


author: Ruslan Shmelev <rshmelev@cloudlinux.com> 1.38.4-1
changelog:
- DEF-38080: disable pool usages in wafcl moduel
- DEF-38078 Allow request on errors during communication with wafd
- DEF-38032 Fix chunked POST request body
- DEF-37554: Change the way we handling transaction closure


author: Igor Savenko <bliss@cloudlinux.com> 1.38.5-2
changelog:
- DEF-38450 fix chunk request processing
- DEF-38429 Use iterators for preparing metrics
- DEF-38429 Avoid of sending zeros in metrics
- DEF-38132: wafcl: implement filter to skip coraza for static files
- DEF-38883: wafd: return logic to check location and file_name matching
- DEF-38780: refactor convertor.go
- DEF-38779: refactor stats.go file


author: Igor Savenko <bliss@cloudlinux.com> 1.39.0-1
changelog:
- DEF-38652: wafd drops messages silently when communicating with ual
- DEF-38706: wafd: create a separate structure to read/write from/to wafcl module connection
- DEF-39038: wafcl: get rid of chunked request phase
- DEF-39053: wafd: Unify proto message generation via container


author: Igor Savenko <bliss@cloudlinux.com> 1.39.1-3
changelog:
- DEF-39450: wafd: cleanup main package
- DEF-39449: Analize wafd packages with AI
- DEF-38580: WAFD must not apply rules for imunify360-related requests
- DEF-39078: wafd: verdict logic optimization
- DEF-39775: Wafd shows memory leakage when CaptchaDefender IsAttack functionality is enabled
- DEF-39858: Turn wafd netlink errors into error type
- DEF-39327: Investigate Concurrent Access Issue in Persistence Storage
- DEF-39778: wafd: eliminate os.Stat call
- DEF-40046: wafcl: change error log level to warning
- DEF-39638: Fix processing of real client ip by coraza


author: Pavel Artsishevsky <Pavel Artsishevsky> 1.6-1
changelog:
- DEF-6893: Disable TLSv1 in WebShield
- DEF-6904: Outdated webshield self-signed SSL certificate
- DEF-6863: Make webshield use first SSL certificate when no SNI.


author: Igor Savenko <bliss@cloudlinux.com> 1.6-3
changelog:
- DEF-7199: Raised 'backlog' parameter to 'listen' syscall to SOMAXCONN to address more parallel connections.


author: Igor Savenko <bliss@cloudlinux.com> 1.6-4
changelog:
- DEF-7327: wsshdict split to master and worker
- DEF-7332: Sentrylogs modified to use new imunify360-webshield sentry project
- DEF-7206: webshield/wsshdict log processing modified to resemble sentry errors/exceptions
- gen_ports_conf script rewritten in Python (because we need predictable regex engine)
- DEF-7191: Added webshield port reservation via sysctl


author: Igor Savenko <bliss@cloudlinux.com> 1.6-8
changelog:
- DEF-7685: Disabled backend proxying
- DEF-7747: package scriplets/systemd unit files/init files revision


author: Igor Savenko <bliss@cloudlinux.com> 1.6-14
changelog:
- DEF-8080: ssl-cache reimplementation
- DEF-7991: ipdetect crashes when all domains are dedicated ones
- DEF-8110: sentrylogs can use up to 6000 threads and more.
- DEF-8096: Allow uploads of files of any size


author: Igor Savenko <bliss@cloudlinux.com> 1.5-6
changelog:
- DEF-6614: Fixed processing IPv6 requests for non-SNI certificates
- DEF-6771: Added deduplication of domains when backend-destination.conf is being saved


author: Igor Savenko <bliss@cloudlinux.com> 1.7-3
changelog:
- DEF-7573: Make webshield use new LPC tries functionality
- DEF-7990: Webshield experiences memory leakage when ssl-caching daemon is down


author: Igor Savenko <bliss@cloudlinux.com> 1.7-7
changelog:
- DEF-7938: Add webshield CSF PT_USERKILL exclusions
- DEF-8061: Find no-cache headers to clients like varnish
- DEF-8294: Prepare build script for jenkins builds
- DEF-8281: Added domain to SSL cache
- DEF-8275: changed webshield captcha 'static' endpoint to much less predictable string
- DEF-8330: Mark all config files as NOT conffiles to avoid questioning on update


author: Igor Savenko <bliss@cloudlinux.com> 1.7-8
changelog:
- DEF-8510: Remove process ID from sentry message ('cause they are always different)
- DEF-8281: Get cpanel domain from certificate pem file


author: Igor Savenko <bliss@cloudlinux.com> 1.7-10
changelog:
- DEF-8482: Process 'X-Forwarded-For' header only after vendor-specific headers
- DEF-8236: Wsshdict, ssl-cache and sentrylogs: rewrite existing PID file silently on start


author: Igor Savenko <bliss@cloudlinux.com> 1.7-12
changelog:
- DEF-6741: Immunify Farsi Translation
- DEF-8641: Added 'expires off' parameter to forbid adding or modifying 'expires' and 'cache-control' headers
- DEF-8561: Disable sentry client logging to syslog
- DEF-8614: User google account for Recapcha


author: Igor Savenko <bliss@cloudlinux.com> 1.8-7
changelog:
- DEF-9752: Create a script to enable/disable webshield
- DEF-8614: User google account for Recapcha bugfix


author: Igor Savenko <bliss@cloudlinux.com> 1.8-8
changelog:
- DEF-9752: Fixed for ubuntu 18.04. Renamed script to 'webshieldctl'. Added separate actions for enable/disable, start/stop, activate/deactivate
- DEF-9905: Self-signed certificate is no longer removed on uninstallation


author: Igor Savenko <bliss@cloudlinux.com> 1.8-9
changelog:
- DEF-9752: Added 'is-active', 'is-enabled' actions
- DEF-9905: Self-signed cert removal is made dependent on scriplet argument


author: Igor Savenko <bliss@cloudlinux.com> 1.7-14
changelog:
- DEF-7079: Bring back splashscreen to webshield
- DEF-8121: Country block in webshield
- DEF-8238: Disable client body buffering
- DEF-9040: Webshield shared memory daemon segfaults when message size exceeds 2048 bytes
- DEF-8939: Custom whitelisted/blacklisted IPs support in webshield
- DEF-9031: Modify imunify360-webshield-compose-whitelist script to use custom black and white lists
- DEF-5385: Use splashscreen as captcha for Chinese customers


author: Igor Savenko <bliss@cloudlinux.com> 1.8-2
changelog:
- DEF-8964: Added cron job for restarting wsshdict in EL6 environment
- DEF-9249: When a host with cPanel has no user accounts, ssl-cache daemon does not start


author: Igor Savenko <bliss@cloudlinux.com> 1.8-6
changelog:
- DEF-9354: Added PROXY protocol support for webshield
- DEF-9551: Update webshield to OpenResty-1.15.8.1


author: Timur Irmatov <tirmatov@cloudlinux.com> - 1.0.0-3
changelog:
- DEF-12384 SSL cache CLI updates default dests
- DEF-12330 Add required scripts
- DEF-12384 Make SSL cache daemon and CLI a single binary
- DEF-12384 Move ssl_cache_update to cli directory
- DEF-12384 Refactor CLI tool, add unit tests
- DEF-12330 Add buildsystem script
- Edit project structure, extract service files from webshield
- Fix non-installing binaries on debian
- Fix integration tests to work with plesk nginx environment
- Bump go version to 1.14.1
- DEF-12421: nil dereference in main()
- DEF-11890 Add integration test body
- DEF-11890 Add cPanel mock for integration tests
- DEF-11890 Add DirectAdmin mock for integration tests
- DEF-11890 Add Plesk mock for integration tests
- Fixes for domain checker and wsshdict
- DEF-12301 Unit test for Plesk.GetUserCertsPath
- DEF-12301 Unit test for Plesk.LastModified
- DEF-12301 Fix cert path detection on Plesk
- DEF-12301 Add os detection
- DEF-11890 Add certificate helper
- DEF-11890 Add wsshdict client
- DEF-11890 Add domain checker
- Remove unnecessary DeleteFile function
- DEF-12300 Unquote cert paths on plesk
- DEF-12298 GetCertCommonName return wrong name
- DEF-11888: fix packaging for RPM


author: Pavel Kuzmuk <pkuzmuk@cloudlinux.com> - 1.1.0-1
changelog:
- DEF-12857 Use log levels, change frequent messages' level to debug
- DEF-12857 Add levels for logging
- DEF-12690 Process dedicated ip vhosts dir on Plesk
- DEF-11160 Add support for OpenLiteSpeed in DirectAdmin


author: Pavel Kuzmuk <pkuzmuk@cloudlinux.com> - 1.1.1-1
changelog:
- DEF-13422 Add ability to parse multiple vhosts in one webserver config
- Remove force installation from integration tests
- DEF-12963 Remove service exit if syslog/sentry is not available
- DEF-12941 Enable reporting based on agent config
- Remove Jenkinsfile due to moving to unified unit tests job


author: Aleksandr Vorobev <avorobev@cloudlinux.com> - 1.3.0-1
changelog:
- DEF-13547: memorize manually-added certificate for supported panels
- DEF-13547: add unit tests for ssl_cache package
- DEF-14498: review and improve test coverage
- DEF-14804: handle litespeed as apache for directadmin


author: Aleksandr Vorobev <avorobev@cloudlinux.com> - 1.4.0-1
changelog:
- Update Go version to 1.15.6
- DEF-15164: add logging of domain certs
- Add unit test for cacheUpdateLoop
- Add trace flag, remove test mode
- DEF-15363: fix CLI display of certs, improve tests


author: Rushan Shaymardanov <rshaymardanov@cloudlinux.com> - 2.0.1-1
changelog:
- DEF-16629 Add README.md
- DEF-16812 update license
- DEF-16787 use commit hash in gerrit builds
- DEF-16747: Change sentry DSN
- DEF-16576: fix SIGPIPE handling


author: Ruslan Shmelev <rshmelev@cloudlinux.com> - 1.0-0
changelog:
- modify cron to update from the stable repository
- bump version numbers to 1.0-0
- bump component versions to the stable ones


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 3.0.0-1
changelog:
- New upstream release
- Updated no_pprof patch to match new release
- Updated s390 patch to match new relase
- Added make check
- Added new script jemalloc.sh
- Added a patch for atomic operations on epel5/ppc


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 3.5.1-1
changelog:
- New upstream release
- Updated nopprof patch to match new release
- Fixed a few bogus changelog entries


author: Sebastien Willmann <sebastien.willmann@gmail.com> - 0.6.0-0.3.rc2
changelog:
- Removed static package
- Preserving timestamp on installed files
- Added guard grep to the sed expression
- Removed duplicated doc files
- Removed dependency on pkgconfig
- Changed base package group


author: Björn Esser <fedora@besser82.io> - 0.10.5-1
changelog:
- Update to version 0.10.5
- Use %license and %doc properly
- Add generated CMake-target
- Move %check after %install
- Remove Group-tag, needed for el <= 5, only
- Drop Patch0, not needed anymore
- Disabled Werror
- Add disttag
- Use cmake instead of scons


author: Rex Dieter <rdieter@fedoraproject.org> 2007e-13
changelog:
- _with_system_libc_client option (el6+) 
- tight deps via %?_isa
- drop extraneous Requires(post,postun): xinetd


author: Andreas Schneider <asn@redhat.com> - 1.0.0-1
changelog:
- Update to version 1.0.0:
  * Added new test runner with group fixtures. The old runner is deprecated
  * Added an extensible message output formatter
  * Added jUnit XML message output
  * Added subunit message output
  * Added Test Anything Protocol message output
  * Added skip() command
  * Added test_realloc()
  * Added a cmockery compat header
  * Fixed a lot of bugs on Windows


author: Andreas Schneider <asn@redhat.com> - 1.0.1-1
changelog:
- Update to version 1.0.1:
  * Added a macro for assert_ptr_equal().
  * Fixed test_realloc() if 0 size is passed.
  * Fixed objects packaging bug.
  * Fixed building with newer gcc versions.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.0-1
changelog:
- Update to version 1.1.0
    * Added support to catch multiple exceptions
    * Added support to verify call ordering
    * Added support to pass initial data to test cases
    * Added will_return_maybe() for ignoring mock returns
    * Added subtests for groups using TAP output
    * Added support to write multiple XML files for groups
    * Improved documentation
    * Fixed XML output generataion
    * Fixed Windows builds with VS2015


author: Jan Vcelak <jvcelak@fedoraproject.org> 1.1.1-4
changelog:
- remove utils subpackage and place mmdblookup into devel subpackage
- remove Group from the spec file
- move NOTICE and Changes.md to devel subpackage


author: Remi Collet <remi@remirepo.net> - 1.0.16-1
changelog:
- update to 1.0.16
- soname bump to 23 (libsodium13 compat package exists)
- manage update from libsodium23 (3rd party repository)
- Add static library subpackage
- fix license management


author: Miroslav Rezanina <mrezanin@redhat.com> 1.1-2
changelog:
- lu-Fix-rpmdiff-failure.patch [bz#1229359]
- lu-Fix-buffer-overflow-reported-by-Coverity.patch [bz#1233114]
- Resolves: bz#1229359
  (Fix multilib support)
- Resolves: bz#1233114
  (fix off-by-one in dwarf_to_unw_regnum (CVE-2015-3239))


author: Miroslav Rezanina <mrezanin@redhat.com> 1.1-5
changelog:
- Version bumped [bz#1238864]
- Resolves: bz#1238864
  libunwind: bump version to win against existing branches


author: Miroslav Rezanina <mrezanin@redhat.com> 1.1-6.el7
changelog:
- Fix update from EPEL version [bz#1289950]
- Resolves: bz#1289950
  (libunwind in RHEL 7.2 has a smaller release than the last libunwind package in EPEL-7)


author: Miroslav Rezanina <mrezanin@redhat.com> 1.2-2.el7
changelog:
- Rebase to 1.2 [bz#1384435]
- Resolves: bz#1384435
  (Rebase libunwind package (and add for ppc64le): libunwind)


author: Sandro Mani <manisandro@gmail.com> - 2.0.0-2.svn20140403
changelog:
- Remove thirdparty libraries folder in prep
- Own %{_libdir}/openjpeg-2.0/
- Fix Requires
- Add missing ldconfig
- Add possibility to run conformance tests if desired


author: Sandro Mani <manisandro@gmail.com> - 2.0.0-4.svn20140403
changelog:
- Replace define with global
- Fix #define optional_components 1S typo
- Fix %(pwd) -> $PWD for test data
- Added some BR for optional components
- Include opj2_jpip_viewer.jar in %files


author: Benjamin Gilbert <bgilbert@backtick.net> - 3.3.3-1
changelog:
- New upstream release
   + Minor compatibility improvements for Aperio JP2K and Hamamatsu slides
- Update Source0 URL


author: Support <support@atomicorp.com> - 2.8.3-53
changelog:
- Add logrotate for RHEL 7 (logrotate 3.8+)
- Update rootkit definitions, add rhel7 audit checks
- Issue #769, fix MAX_AGENTS limit in ossec-hids-server
- Issue #782, /var/ossec/tmp was not available in ossec-hids-client


author: Support <support@atomicorp.com> - 2.8.1-47
changelog:
- Update to 2.8.1. This is identical to 2.8.0-46, the only change is the hosts.deny CVE-2014-5284 is merged in.


author: CloudLinux Packaging Team <packages@cloudlinux.com> - 0.1.0-0
changelog:
- Initial release
- Signature-based PHP malware detection
- PCRE2 regex engine for compatibility
- HyperScan pre-filtering support
- JSON/CSV/text output formats
- Parallel scanning support
- Imunify360 detached mode integration


author: CloudLinux Packaging Team <packages@cloudlinux.com> - 0.1.0-1
changelog:
- Switch to source-based build with vendored dependencies
- Build hyperscan from source during package build


author: CloudLinux Packaging Team <packages@cloudlinux.com> - 33.0.2-1
changelog:
- Fix VULN-ESUS detections reported as non-suspicious (cloudscan)
- Add /proc process stats to JSON report for Imunify360 agent parity


author: CloudLinux Packaging Team <packages@cloudlinux.com> - 33.2.0-1
changelog:
- PHP-VM deobfuscation engine:
-   Full PHP-VM: parser, evaluator, 100+ builtins, scanner integration
-   Remove legacy deobfuscator (~35K LOC), VM is sole engine
-   Fuzzy superglobals, SourceCop/GLOBALS resolution, stack overflow protection
-   Tokenizer/parser hardening, parity normalization up to 325 MATCH
-   Improved VIRII detection with eval supplement and assert_options heuristic
- Performance:
-   Hyperscan inline verify (3.22x faster than PHP aibolit)
-   Zero-allocation pipelines, LTO, rayon ThreadPool, byte-native builtins
- Fixes:
-   Handle non-existent scan paths gracefully
-   VULN-ESUS ID joining to match PHP aibolit
-   PCRE octal/hex escape handling in prefilter
-   Archive extension filter fix


author: CloudLinux Packaging Team <packages@cloudlinux.com> - 33.3.0-1
changelog:
- CI/test stability:
-   Prevent test-long hangs by enforcing PHP-VM deadlines in parser/evaluator loops
-   and long-running builtins/tokenizer/safe_exec paths
-   Fix safe_exec build without php_vm feature (feature-gated deadline check)
-   Fix parse_str one-arg loop ordering so empty '&' pairs cannot bypass tick()


author: CloudLinux Packaging Team <packages@cloudlinux.com> - 33.3.1-1
changelog:
- Replace inotify with directory polling in resident mode
- Fix resident report errors format to match PHP aibolit
- Harden hyperscan DB loader safety
- Fix build with CMake 4.x


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 33.3.2-1
changelog:
- Load the optimized exclude list (av-internal-optimized.txt) when the agent
  provides it, falling back to the legacy av-internal.txt so existing
  installations keep working unchanged. The filter-enabled flag now also
  considers the optimized file, preventing a disabled-filter state if only
  the legacy file is absent. (DEF-41538)
- Enforce a heap memory limit in resident mode via DiagnosticAllocator and
  the new MALWARE_SCAN_INTENSITY.resident_ram config knob (default 2048MB).
  On limit exceeded the allocator logs allocated/limit/requested to stderr
  before aborting, so systemd can restart the process with a diagnosable
  log line instead of OOM-kill. Also respects user_scan_ram for on-demand
  user scans. (DEF-41661)


author: Max Klimchuk <mklimchuk@cloudlinux.com> - 33.3.3-1
changelog:
- Performance:
-   Hyperscan fast-path for ~2,699 CriticalPHP/CriticalJS signatures that
    bypass PCRE2 verification entirely; priority-ordered HS scanning with
    early exit; lazy normalization and deobfuscation precheck; thread-local
    Pcre2MatchContext reuse (3.22x faster than PHP aibolit) (DEF-40587)
- Cloud Instant Scan (CIS):
-   Gate CIS activation behind per-server feature flag cis_enabled in
    /var/imunify360/feature_flags.json — fail-closed when absent (DEF-41855)
-   Async fire-and-forget file upload to correlation server during scan
    instead of post-scan, with ignore-list enforcement moved into the
    scanner (DEF-40017)
- Rustcurator cleanup improvements:
-   Add inline base64 expansion to cleanup ContentObject so signatures
    matched on expanded content can be mapped back to raw file (DEF-41768)
-   Add goto-unwrap content view to cleanup pipeline for files detected
    via goto-unwrapping under --deobfuscate (DEF-41769)
-   Remove 19 test exclusions and validate full cleanup pipeline (DEF-41770)


author: Max Klimchuk <mklimchuk@cloudlinux.com> - 33.3.4-1
changelog:
- Detached mode stability:
-   Install crash signal handlers (SIGSEGV/SIGBUS/SIGABRT/SIGFPE) with RSS
    diagnostics so second-scan silent exits produce a traceable log line
    instead of vanishing without a trace (DEF-42027)
- Reporting:
-   Add 6 missing PerformanceStats timing fields (cas_time, scan_time_hs,
    smart_time_hs, scan_time_preg, smart_time_preg, deobfuscate_time) to
    JSON report so the Python agent can forward them to ClickHouse (DEF-41995)


author: Max Klimchuk <mklimchuk@cloudlinux.com> - 33.3.5-1
changelog:
- Performance recovery (DEF-42521):
-   Recover ~5-10% of the scan-time regression introduced in 33.3.3,
    measured across VIRII / sig_samples / mixed datasets; detection
    parity preserved (byte-identical critical/suspicious/files counts)
-   Replace linear .windows() scans with SIMD-accelerated memchr/memmem
    prechecks in heuristic gates (has_case_insensitive_eval/_create_function,
    has_concat_function_call) and PHP tokenizer (strip_comments_fast,
    split_halt_compiler, find_bytes)
-   Fuse @ removal + whitespace collapse + operator-space normalization
    into one O(n) byte pass (replaces 3 separate full-content passes
    in normalize_for_scanning and normalize_and_deobfuscate)
-   Gate iterative decode loop on chr/backslash/% byte prechecks; skip
    PCRE2 entity/concat passes when content has no candidate bytes
-   Pool thread-local Pcre2MatchContext to avoid 3 C mallocs per quick::
    call; add fast static-string PCRE2 replace path that skips capture
    extraction
-   Replace mmap+to_vec with direct read for files <= max_size (saves
    ~54K syscalls on the VIRII corpus)
- Resident mode (file-upload throughput / DEF-42057):
-   Persist CloudScanner across scan_files() calls so each upload job no
    longer recreates the CIS HTTP client and re-runs DNS/TLS handshake
-   Add 2s connect_timeout to the CAS HTTP client so an unreachable
    correlation server fails fast instead of stalling each upload by 30s
-   Bump default --resident-stay-alive from 30s to 300s so the daemon
    stays warm between bursts of uploads
-   Feed systemd watchdog from a dedicated background thread so heavy
    scan CPU cannot starve the heartbeat
- CloudScan memory safety (DEF-42360):
-   Skip oversized files before read so a single large file cannot
    cause runaway disk reads / OOM (~800MB/s reported in the field)
-   Use max(max_size, max_elf_size) as the absolute cap for cloud-eligible files
- Whitelist (DEF-42192):
-   Implement /etc/imunify360/malware-ignore-hashes.txt SHA256 ignore
    list so customer-whitelisted files are no longer detected/deleted
- Cloud Instant Scan (DEF-42093):
-   Scope rustbolit submissions to Suspicious detections only — stops
    Critical/Phishing/Adware/ExtendedSuspicious from being re-classified
    via CIS, eliminating duplicate malware_hits rows


author: Max Klimchuk <mklimchuk@cloudlinux.com> - 33.3.6-1
changelog:
- Resident mode (DEF-43066, follow-up to DEF-42057):
-   Preempt notify-batches between files so a modsec/FTP upload-job
    arriving mid-batch no longer waits past the 10s UPLOAD_TIMEOUT
    (380-file batch: ~10.5s -> ~150ms p95)
- Detection metadata (DEF-43006):
-   Populate file hash for every detection type (cloud-assisted,
    vulnerability, ELF, cached) so malware reports no longer carry
    empty hash fields
-   Include cloud-assisted detections in resident-mode malware
    counts so the daemon log line matches the report file


author: Max Klimchuk <mklimchuk@cloudlinux.com> - 33.3.7-1
changelog:
- Detached/resident scanning (DEF-43268):
-   Fix malware cleanup failure on hosters with a symlinked /home
    (e.g. Cloudways) by reporting canonical file paths to the
    Imunify360 agent


author: Max Klimchuk <mklimchuk@cloudlinux.com> - 33.3.8-1
changelog:
- Resident mode (DEF-43431):
-   Temporarily disable CAS/CloudScan in resident scan_files path due to
    unstable CAS connectivity; keep code commented for quick rollback


author: Max Klimchuk <mklimchuk@cloudlinux.com> - 33.3.9-1
changelog:
- Resident mode (DEF-43287, Layer 6 — primary customer-visible fix):
-   Fix ~10s upload timeouts (modsec "TimeoutError: timed out") caused
    by the activation-socket kernel queue accumulating past
    max_dgram_qlen=512. Drain the queue on every watchdog tick
    (was: once per WatchdogSec/2 = 30s), accept fd 3 on LISTEN_PID
    mismatch (defensive workaround for the ai-bolit/wrapper fork+exec
    bug — upstream twin-fix in aibolit-master), and force O_NONBLOCK
    on the activation fd so the drain loop cannot hang.
- Resident mode (DEF-43287, Layer 3):
-   Retry job-file parse with a 200ms budget when modsec's
    open+write+close isn't yet atomic on the watcher's side; quarantine
    malformed jobs as .bad for forensics instead of unlinking them.
- Packaging (DEF-43287, Layer 5):
-   try-restart aibolit-resident.{socket,service} on rustbolit upgrade
    so the new binary takes effect immediately instead of waiting for
    the next idle stay-alive exit.


author: Max Klimchuk <mklimchuk@cloudlinux.com> - 33.3.10-1
changelog:
- Memory leak (DEF-44263):
-   Fix unbounded resident-mode RSS growth that could exhaust cgroup
    memory and trigger silent OOM restarts on long-running daemons
- Memory footprint (DEF-44239):
-   Honor the agent's MALWARE_SCANNING.hyperscan flag in resident mode
    so small-RAM hosts (<2 GB) no longer load the 98 MB Hyperscan
    databases when Imunify360 has them turned off, cutting resident
    RSS from ~350 MB to ~110 MB on those servers
- Performance (DEF-44159):
-   Speed up weekly scans on accounts with mostly-unchanged files by
    skipping cloud lookups and SHA256 hashing for files whose mtime
    matches the cached verdict, eliminating most per-file cloud-scan
    overhead on warm caches
- Whitelist (DEF-42192):
-   Apply the /etc/imunify360/malware-ignore-hashes.txt SHA256 ignore
    list to cloud-assist, cached-verdict, and ELF detection paths so
    customer-whitelisted files are no longer flagged via those paths
- Resident mode (DEF-43910):
-   Silence "Cannot find unit for notify message" warnings from the
    systemd journal by claiming the daemon's MainPID on every
    notification


author: Benjamin Gilbert <bgilbert@backtick.net> - 8.5.6-1
changelog:
- New release
- Rename Python packages per policy
- Update project URLs
- Rename pygobject3-base dependency to python-gobject-base
- Switch python3-gobject dependency to python3-gobject-base
- Add missing arch-specific Python provide
- Drop Group tags


author: Michal Ambroz <rebus at, seznam.cz> - 3.5.0-3
changelog:
- package review - bugzilla #1362265
- dropped Buildroot, pkgconfig, zlib-devel, defattr
- added buildrequires gcc
- change license back to ASL 2.0 only


author: Michal Ambroz <rebus at, seznam.cz> - 3.5.0-4
changelog:
- package review - bugzilla #1362265
- cosmetics of the changelog
- using default spinx theme to remove the static fonts


