https://blog.kalfaoglu.net/tags/firewall/Recent content in Firewall on kalfaoglu.netHugoenSun, 13 Sep 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-09-13-csf-cve-2026-67402-en/Sun, 13 Sep 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-09-13-csf-cve-2026-67402-en/<p>If your server runs cPanel with ConfigServer Firewall (CSF), drop what you&rsquo;re doing and check your CSF version. On September 3, 2026, cPanel pushed a critical patch for <a href="https://www.cve.org/CVERecord?id=CVE-2026-67402">CVE-2026-67402</a> — a remote code execution vulnerability in CSF&rsquo;s Messenger service that lets an unauthenticated attacker run arbitrary commands as the Apache user. That&rsquo;s a bad sentence to read about a piece of software whose entire job is to protect your server.</p> <h2 id="what-is-csf-and-why-did-cpanel-inherit-it">What Is CSF, and Why Did cPanel Inherit It?</h2> <p>ConfigServer Security &amp; Firewall has been a staple of cPanel/WHM setups for years — it&rsquo;s the iptables-based firewall layer that handles port blocking, login failure detection, and email alerts. The original developer discontinued it on August 31, 2025 and released the code as open-source under GPLv3. cPanel (now WebPros) stepped in on February 25, 2026 and forked it, taking over security maintenance.</p>