Security: CSF Security Release - September 3rd, 2026

Situation

A vulnerability was found in the MESSENGER service in the ConfigServer Firewall (CSF) software which could allow for unauthorized code execution.

This has a public CVE record listed with further information: CVE-2026-67402

Note: By default, the MESSENGER service is disabled.

Affected Product versions

Impact

Exploiting this could allow an attacker to execute code as the Apache user.

Call to action

Update to the latest version of the ConfigServer Firewall plugin:

Mitigation

It is highly recommended that you update the installed CSF version as soon as possible.

If this is not possible, you can disable the MESSENGERV3 setting in CSF.

1. Access the server as the root user via SSH, or the Terminal in WHM.

2. Edit the CSF configuration file:

   # nano /etc/csf/csf.conf

3. Update the MESSENGERV3 option to be disabled:

   CONFIG_TEXT: MESSENGERV3 = 0

4. Save and restart the CSF and LFD services:

   # systemctl restart csf lfd