Check: <https://nvd.nist.gov/vuln/detail/CVE-2026-67402>

Check:

A critical vulnerability was found in the MESSENGER service in the ConfigServer Firewall (CSF) software which could allow for unauthorized code execution.
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros (Cpanel team) addressed the vulnerability in version 16.31.

This has a public CVE record listed with further information: CVE-2026-67402

Note: By default, the MESSENGER service is disabled.

Affected Product versions:
Product: csf

Affected Versions: CSF 16.30-1 and older

Patched Versions: 16.31+

Impact:
Exploiting this could allow an attacker to execute code as the Apache user.

Mitigation:

It is highly recommended that you update the installed CSF version as soon as possible.

If this is not possible, you can disable the MESSENGERV3 setting in CSF.

Access the server as the root user via SSH, or the Terminal in WHM.

Edit the CSF configuration file:

nano /etc/csf/csf.conf

Update the MESSENGERV3 option to be disabled:

MESSENGERV3 = 0

Save and restart the CSF and LFD services:

csf -ra

Version from Aetherinox was not updated yet. Is recommmended you use mitigation above.

Do it as soon as possible, my self server already was attacked.

Regards,
Netino

I am using the fork: https://github.com/aetherinox/csf-firewall
It is fully compatible with CWP Pro, and the latest version is 15.10

13 hours ago, TheHolbi said:

I am using the fork: https://github.com/aetherinox/csf-firewall
It is fully compatible with CWP Pro, and the latest version is 15.10

I’m using it too, but unfortunately, they haven’t fixed that vulnerability and are still on version 15.10—which is the one I’m using. It’s been a month, and there hasn’t been an update yet. So, I’m already considering switching to the black-host version, which has already patched the vulnerability in a new release.

9 hours ago, Netino said:

I’m using it too, but unfortunately, they haven’t fixed that vulnerability and are still on version 15.10—which is the one I’m using. It’s been a month, and there hasn’t been an update yet. So, I’m already considering switching to the black-host version, which has already patched the vulnerability in a new release.

In this case, I suggest you open a ticket on GitHub about this.