CVE-2026-67402: ConfigServer Firewall Had a Hole. Our Servers Have Been Patched.

This morning, September 3, a critical security advisory landed for ConfigServer Firewall, the software better known as CSF that guards a huge share of the world’s cPanel servers. CVE-2026-67402 allows an unauthenticated attacker to execute code through CSF’s Messenger service. By the time you are reading this, every GillyTech server was already running the patched release. Advisory in, fleet patched, then the blog post. That order never changes here.

The Firewall Was the Hole

There is an uncomfortable irony in this one worth sitting with. CSF is a security product. Its Messenger service exists to show blocked visitors a polite page explaining why the firewall stopped them. According to the advisory, that same service could be exploited by an attacker with no credentials at all to run code on the server as the Apache user.

Code execution as Apache is not root, but it is a foothold on the web server itself, the place where sites, their files, and their traffic live, and footholds are what attackers build ladders from. An unauthenticated entry point in a component that faces the open internet by design is exactly the kind of flaw that gets scanned for at scale within days of disclosure.

The broader lesson is one every layered-security practitioner already knows: security tools are software too. Firewalls, scanners, and monitoring agents carry their own attack surface, which is why defense cannot be a single product you install and trust. It has to be an architecture.

Affected and Fixed Versions

CSF versions 16.30-1 and older are affected. The fix is CSF 16.31 or later. If your server runs an end-of-life version of cPanel & WHM, it will not receive CSF updates at all, and upgrading to a supported release is the only path to the patch.

Mitigation: How to Patch Right Now

If you manage your own cPanel server, servers configured for automatic updates will pick up the patched build on their own, but with an unauthenticated flaw in an internet-facing service, immediately beats overnight. SSH in as root and run:

yum clean all
/scripts/update-packages

Then confirm the installed CSF version is 16.31 or later:

csf -v

cPanel’s support portal carries the full advisory, and their general update documentation covers package updates in more detail.

Our Side of the Ledger

This is the third critical advisory we have published a same-day response to in recent weeks, after the cPanel domain parking flaw and in the same tradition as the LiteSpeed CVE and the Copy Fail Linux exploit before it. The pattern is deliberate. Patching is not a ticket in a queue at GillyTech; it is the interrupt that outranks everything else on the board.

Our fleet was updated to CSF 16.31 and verified within minutes of the advisory arriving, and because our platform layers protections rather than leaning on any single tool, a flaw in one control never means the door is open. Isolation, monitoring, and aggressively current infrastructure back each other up precisely because days like today happen.

If your hosting lives elsewhere, today’s question for your provider writes itself: what CSF version are my servers on, and when did it get there?

Want your servers handled by people who treat patch day as the top priority? GillyTech runs managed WordPress hosting and application hosting where security updates land in minutes, not maintenance windows. Schedule a call.