Recent content by Fede Marsell

Thank you for your confirmation @Hangover2 You are correct. Affected users should save the logs directory /var/log/imunify360/ as proof of the illegal data transfer. This is necessary for future action.

This affects thousands of servers running PLESK, yet here we are, just three users concerned about security. The rest of the community seems asleep. I've been managing servers for decades, and the current feeling is that no one cares about security. Plesk installs extensions without your...

The problem is that both the installation of the extension and the data transfer happened without any prior authorization or consent. This is a serious breach.

As I've already told you, that's false. Affected users can check it for themselves. They just have to run a simple grep: grep Uploaded /var/log/imunify360/console.log

Absolutely not. You are seriously mistaken.

I manage many servers, on almost all of them (99%) Imunify was installed automatically (without consent), and this data transfer appears on all of them. It would be helpful if someone from Imunify or PLESK could explain how these files, which have been transferred without any consent, are handled.

As many PLESK users have seen, a few days ago, the Imunify extension was installed automatically. This installation was carried out without your consent. This fact, in itself, is quite serious. The reason for this post is that it is possible that much of your data has been transferred by this...

I've never installed Imunify and I've never purchased a license for this extension. Never. I manage more than 50 servers with PLESK, and on most of them, Imunify was automatically installed without consent and has sent sensitive information to external servers. Any user can review its logs...

Once Imunify is installed —even without explicit permission— it begins scanning the server and uploading files it deems suspicious to external servers. The extent of this behavior is unclear: it's not known whether Imunify uploads entire files or just fragments. Regardless, this constitutes a...

The extension is installed without permission. Then, that extension publishes your files, containing sensitive information, to repositories you don't know about. imav.malwarelib.utils.malware_response: Uploaded file to the Malware Response Service with reason: extended-suspicious Okay, who...

Is there any way to block this extension from panel.ini? It installs itself, automatically, even after uninstalling. And as is typical in PLESK practices, without any permission :mad:

I’ve changed the name on all the servers. Problem solved. To be honest, it seems like a huge mess. I often wonder what justifies the price of PLESK licenses. These kinds of mistakes are pretty common.

The error is related to laminas-mail. This component was updated in the latest PLESK update. It seems to have problems with the administrator name (it includes a hyphen and a comma). Incredible. Who developed this? I've changed the name in PLESK, and tomorrow I'll check if the emails are being...

Thank you for your response. Plesk is configured as local. The addresses to which the overuse notifications are sent are either local or remote (e.g., Gmail, Hotmail, etc.). I've checked the maillog, and Plesk is not sending the emails — there's no record of any attempt. I’m attaching two...

Hello, @Sebahat.hadzhi No, I don't have any extensions. As I mentioned, the problem occurred on several servers at once. The only thing I did was upgrade to Plesk Obsidian 18.0.68 Update 2. If you tell me what you need, I can provide the details, of course.