kalfaoglu.net blog

If your server runs cPanel with ConfigServer Firewall (CSF), drop what you’re doing and check your CSF version. On September 3, 2026, cPanel pushed a critical patch for CVE-2026-67402 — a remote code execution vulnerability in CSF’s Messenger service that lets an unauthenticated attacker run arbitrary commands as the Apache user. That’s a bad sentence to read about a piece of software whose entire job is to protect your server. What Is CSF, and Why Did cPanel Inherit It? ConfigServer Security & Firewall has been a staple of cPanel/WHM setups for years — it’s the iptables-based firewall layer that handles port blocking, login failure detection, and email alerts. The original developer discontinued it on August 31, 2025 and released the code as open-source under GPLv3. cPanel (now WebPros) stepped in on February 25, 2026 and forked it, taking over security maintenance. ...

On August 27, 2026, cPanel pushed an unscheduled security update and sent a customer notification that most people probably skimmed past. They shouldn’t have. The flaw, assigned CVE-2026-65643, lets any authenticated cPanel account that has permission to add parked or addon domains create arbitrary files on the underlying server — which in practice means full root-level code execution. That’s not a privilege escalation hidden behind multiple hoops. That’s a regular shared hosting customer owning the machine. ...

On August 10, 2026, Wietse Venema released Postfix 3.11.6, along with coordinated updates for six legacy branches: 3.10.13, 3.9.14, 3.8.20, 3.7.22, 3.6.20, and 3.5.27. If you run mail on Linux, you almost certainly run Postfix. You should update. The release is unusual for two reasons: the scope of what was found, and how it was found. How the bugs were discovered Qualys, working with Anthropic’s Claude Mythos Preview, and separately OpenAI Security, ran an AI-assisted audit of the Postfix codebase — over 150,000 lines of C accumulated across nearly three decades of single-developer maintenance. The results were, to put it charitably, humbling. More than half of the discovered defects date from 20 or more years ago. The oldest traces back to before Postfix’s first public alpha release in April 1997. ...

On July 22, Qualys published a Linux kernel advisory that anyone running shared hosting on a RHEL-family system should read before doing anything else: CVE-2026-64600, nicknamed RefluXFS. It is a local privilege escalation to root in the Linux kernel’s XFS filesystem, and the proof-of-concept Qualys published strips the root password from /etc/passwd in seconds — starting from an ordinary, unprivileged local account. The vulnerability has been sitting in the kernel since version 4.11, released in 2017. Nine years of shared hosting servers, VPS instances, and cloud nodes, quietly exposed. ...

F5 patched CVE-2026-42533 on July 15. If you run nginx, this one deserves your attention before the proof-of-concept code drops — and there is a countdown on that. What the flaw is The vulnerability is a heap buffer overflow (CWE-122) in nginx’s script engine — the component that assembles output strings from configuration directives at request time. It surfaces under a specific configuration pattern: a map block using regex matching, where the map’s output variable appears in a string expression after a numbered capture variable ($1, $2) from an earlier regex match. ...

Two weeks ago, on July 6, 2026, MariaDB Community Server 10.6 reached end of life. The MariaDB Foundation announced this back in June and gave people several months to plan. Some planned. Many did not. If you are in the second group, here is what you need to know. What “End of Life” Actually Means for a Database End of life does not make your database stop working. Queries keep returning rows, your application keeps humming along, and nothing explodes on day one. What stops is the flow of security patches, bug fixes, and corrective releases from the MariaDB Foundation. The 10.6 branch is now frozen. ...

A working proof-of-concept for CVE-2026-43499, nicknamed GhostLock, went public on July 7, 2026. It hands any unprivileged local user a root shell in about five seconds, and it works from inside a container to escape to the host. If you run Linux servers — shared hosting, VPS, or bare metal — this is the one to patch before anything else this week. What GhostLock is The bug lives in kernel/locking/rtmutex.c, on the futex priority-inheritance (PI) path. When the kernel handles a FUTEX_CMP_REQUEUE_PI requeue and detects a deadlock cycle, it rolls back with -EDEADLK by calling remove_waiter(). The problem: that helper clears pi_blocked_on on the wrong thread — not the sleeping thread it should be cleaning up, but the currently running task. That leaves a live thread holding a dangling pointer into already-freed kernel stack memory. Stack use-after-free. ...

PHP pushed maintenance releases for its two active development branches on July 1–2, 2026. PHP 8.5.8 and 8.4.23 are out. Neither is a major feature release, but they fix issues that can cause real harm to production servers. If you’re hosting PHP applications, patch now. The headliner: CVE-2026-14355 The most critical fix in both releases is CVE-2026-14355, addressing memory corruption in openssl_encrypt() when used with the AES-WRAP-PAD cipher mode (bug GH-22187). Specifically, the internal zend_mm_heap gets corrupted during this operation. Heap corruption is the kind of bug that ranges from “your process crashes at random” to “someone potentially executes arbitrary code,” depending on how the application uses the function and what an attacker can control. If you use PHP’s OpenSSL extension for encryption — and many applications do — this one warrants immediate attention. ...

On June 25, 2026, JFrog Security Research published a working exploit walkthrough for a Linux kernel privilege escalation they named DirtyClone. Tracked as CVE-2026-43503 with a CVSS score of 8.8, it lets any local user on an unpatched system escalate to root — and the attack leaves nothing on disk for forensic tools to find. That combination should get a hosting operator’s attention. What the Bug Is The flaw lives in __pskb_copy_fclone(), a kernel function that copies network packets internally. When a packet is cloned, this function — and a handful of related fragment-transfer helpers — drops a safety flag called SKBFL_SHARED_FRAG. That flag marks packet memory as shared with a file on disk. Once it’s gone, the kernel no longer treats the memory as read-only, and an attacker can write to it. ...

In May 2026, the IETF quietly did something that email administrators have been waiting on for years: they published RFC 9989, RFC 9990, and RFC 9991 — collectively known as DMARCbis. These three documents replace RFC 7489, which has been the authoritative reference for DMARC since 2015. The headline change isn’t technical; it’s procedural. The original RFC 7489 was published as an Informational document, meaning it described what the industry was already doing, not what it was required to do. DMARCbis arrives as a Proposed Standard on the IETF Standards Track — the first formal step toward becoming an Internet Standard. In plain terms: DMARC just graduated from “strong industry recommendation” to “official protocol.” ...