On our shared hosting environment (Register.it, with Imunify360 active as standard account protection), we periodically receive alerts regarding files automatically generated by Scriptcase applications that follow a naming pattern like this:
<grid_or_form_name>_save_flash.class.php
Real-world example (Imunify360 log, 12/10/2026 05:58):
/home/jl4rhhsc/teams.ehisport.it/grid_spr_anagrafica_privacy/grid_spr_anagrafica_privacy_save_flash.class.php
Detected action: file_copy, executed as root, classified as “Detected as malicious”.
Based on their name and context, these files appear linked to a legacy mechanism based on Adobe Flash—a technology deprecated years ago, removed from browsers, and known for numerous historical security vulnerabilities. This code persists in the output generated by our Scriptcase applications, even though Flash is no longer actively used by any of our features.
A similar alert occurred in September 2026; at that time, we marked the files as false positives (without investigating their origin). We would like to know:
- Are these “_save_flash.class.php” files still required for the generated applications to function, or are they remnants of a legacy feature that can be disabled or removed from the code generation process?
- If they are legacy remnants, is it possible to disable their generation at the project or individual application level to prevent them from being created and subsequently flagged by the hosting provider’s security tools? 3. More generally, looking beyond the individual file: the scanning and handling of these recurring “false positives” by tools like Imunify360 places a CPU/resource load on the account. Especially on shared hosting, this could contribute to broader account slowdowns. Have you received similar reports from other customers on hosting plans with active security scanners?
We are happy to provide further examples or logs if helpful.
Thanks,
Roberto