Imunify360’s HardenedPHP can quietly stop your server getting PHP updates

If you have ever used the paid version of Imunify360 on any cPanel servers, double check your PHP versions.

Imunify has a feature called HardenedPHP that replaces cPanel’s PHP and Apache with Imunify’s own versions. They do backport recent patches to older versions, so it can be useful.

However, if you cancel or uninstall Imunify it doesn’t go back to cPanel’s versions, you just stop getting updates. You’re effectively stuck on orphaned versions. They have epoch 1 set, so the OS thinks they are newer versions and won’t warn you that updates have failed.

We’ve reported it to Imunify and they’ve accepted it as a bug.