Validated WHM session context
The WHM CGI preserves the validated cp_security_token required by the native cPanel session. Existing request validation, taint mode and same-origin response boundaries remain in place.
The latest hardened DataHouse CSF/LFD release
DCSFThe latest and most hardened DataHouse CSF/LFD release
A CSF/LFD-compatible firewall distribution with 51 verified security remediations, optional AI System Scan, protected panel workflows and report-first WebGuard across nine deployment paths.
51verified bug and exploit remediations
77/77release qualification gates passed
9panel and Linux deployment paths
WebGuardbounded report-first per-vhost protection
DCSF
Current release and security status
DH20.29 / 15.10.32. Published: 2026-10-08T13:33:03Z. Documentation reviewed: 2026-10-08.
The 51 P-01–P-51 identifiers describe internal remediations, not 51 assigned CVEs. Static Messenger notices are supported; legacy reCAPTCHA self-unblock is disabled.
CVE-2026-65638 / CVE-2026-67402: exact-package assessment
This assessment applies only to the authentic reviewed package and its managed templates. It does not assess every installation or guarantee the absence of every vulnerability. Earlier releases are not assigned a status without separate verification.
Changelog JSON | Security JSON | OpenVEX | llms.txt | llms-full.txt
DCSF
DH20.29: what changed
This release combines WHM context, LFD state and installer repairs with the regression fix found on canary. It supersedes DH20.28; the 51-item security register remains a separate count, without counting tests as vulnerabilities.
Bounded LFD process-state compaction
LFD compacts csf.temppids within its existing size and record limits, using LF_FLUSH to age process records. Accumulated temporary state no longer prevents normal tracking from recording new process identities.
Permissions limited to public cPanel META modules
The compatibility repair sets appropriate permissions only for public cPanel META modules. It does not broaden access across private configuration or the complete cPanel tree.
Reliable reseller-file repair
DH20.29 safely repairs a missing final LF in csf.resellers and corrects the shell error found on the canary. DH20.28 / 15.10.31 is superseded because its reseller repair path was faulty.
Equivalent nftables policy comparison
The comparison accepts a different listing order for independent chains while preserving rule order inside each chain and the remaining policy checks. Reordering independent chains alone no longer causes a false policy mismatch.
77/77 Linux tests and a completed canary
Maintainer qualification passed all 77 Linux test files. The autossltest2 canary update completed with CSF/LFD active and configuration preserved. The separately checked production host has passed dry-run only; this is not a production-upgrade claim.
Models, data and API costs
Model choices offered by this release: gpt-5-mini, gpt-5.4-mini, gpt-5.6-terra. Availability depends on the administrator’s OpenAI API account.
Selected local security diagnostics are sent to OpenAI after activation. Recognised secret values are redacted, but this is not an anonymity guarantee. store=false is not a Zero Data Retention guarantee; the API account and provider data policies still apply. Optional API usage is billed separately from the free DCSF software. Findings need administrator review and do not guarantee that every security issue is detected.
Retained installation and compatibility fixes
- Native WHM Jupiter interface restored. DH20.27 fixed the cPanel regression where a standalone DCSF HTML document replaced the WHM page. DCSF renders through csf.tmpl and the native master_templates/master.tmpl, retaining panel navigation and responsive layout.
- Taint-mode CGI and bounded template helper. The main CGI retains perl -T, request validation and same-origin responses. A fixed root:root 0700 helper uses cPanel private Perl and Cpanel::Template::process_template through list-form IPC::Open2. It clears interpreter-control environment variables, fixes PATH, accepts no path or template arguments and limits stdin to 32 MiB.
- nginx is the client-address authority. For the verified cPanel EA-Nginx topology, SERVER="auto" selects nginx on public ports 80/443. Its structured edge access feed supplies the real client address. WebGuard does not trust arbitrary X-Forwarded-For values or infer clients from an ordinary Apache backend log.
- Apache reports load, not a client to block. Apache listens on private ports 81/444. Its server-status and optional backend-role feed contribute overload evidence only. The local nginx peer 127.0.0.1 cannot become a blocking candidate. Unsupported or unverified proxy layouts are not assumed to have the same trust boundary.
- One trusted library tree during diagnostics. A diagnostic run of an extracted signed package beside older cPanel CSF keeps the selected package libraries first. An exact legacy prepend of /usr/local/csf/lib reasserts the trusted source root and leaves installed libraries as fallback only. Normal installed execution is unchanged.
- Native snapshot before migration. When iptables-save cannot export a known incompatible iptables-nft table, the cpanel-csf migration saves the complete nft list ruleset and exporter diagnostics with SHA-256 checksums. It proceeds only after proving the parallel legacy backend is inert and securing the exact RPM rollback package.
- Bounded rebuild through trusted CSF. The bootstrap rebuilds only the incompatible standard filter, nat, mangle, raw and security tables in the ip and ip6 families through the already installed, trusted csf -r. Unrelated native tables are not selected for normalization.
- Canonical policy check and automatic rollback. Canonical IPv4/IPv6 policies are compared before and after the rebuild. A missing table, semantic mismatch, interruption or later installation failure triggers restoration. Tests covered all ten standard tables, including a forced mismatch that restored the original policy and configuration.
- Optional AI System Scan. AI System Scan adds quick and deep assessments to the DCSF administration interface. It is disabled by default and requires the administrator to configure a personal OpenAI API key and select a model.
- Bounded evidence and private credentials. A single background scan collects a bounded local security snapshot, with limits on reads, processes, data size and execution time. The API key is kept in a separate root-only file and is never rendered back into the interface.
- Findings tied to supplied evidence. OpenAI Responses API requests use store=false, no tools and strict structured output. Findings and recommendations must cite valid evidence IDs from the submitted snapshot. Results are advisory and do not automatically execute repairs.
- Populated private AI state directories. The installer checks owner, group and permissions of private AI state directories without requiring a directory link count of one. Existing subdirectories on ext filesystems no longer cause a false installation refusal; unsafe ownership or permissions still stop installation.
- Conservative migration gates remain. An exit code 0 from an exporter is not proof of completeness. Migration still refuses unknown diagnostics or active parallel legacy policy. An active standard nftables table missing from the normalized snapshot or a changed canonical policy triggers rollback.
- Separate procfs context budget. Contextual identity checks have a separate, bounded procfs scan budget. Hosts with many processes no longer generate false excessive usage alerts from this budget collision; ordinary process, per-UID and global limits are not relaxed.
- LFD active after production updates. After a successful production-profile update (TESTING=0), the installer restarts LFD and checks the result, including active service state on systemd. The new daemon code takes effect immediately; TESTING=1 installations are not started.
- Bounded registration retry. Installation registration uses the extensionless HTTPS API with bounded retry and backoff. A transient failure can be retried without an unbounded wait; signed identity and source-address checks remain in force.
- SELinux-aware installation. The installer checks SELinux state before using chcon. Disabled SELinux no longer produces misleading relabel warnings, while enabled systems retain context handling.
- Native systemd handling. A systemd-only host no longer reports missing legacy SysV init files or tries to change ownership of files that are not installed. Legacy init remains supported.
- Accurate Apache and ModSecurity checks. Inactive Apache and default ModSecurity log paths are informational. With systemd, actual service state is authoritative: Zimbra's private /opt/zimbra/common/bin/httpd is not mistaken for the system Apache service. Legacy init retains a process fallback.
- Validated Zimbra mail transport. The canonical Zimbra sendmail symlink is recognized through the trusted-path check. This targeted compatibility repair does not make arbitrary symlinks trusted.
Linux release qualification: 77/77. Public-bootstrap checks: 85/85.
DCSF
DH20.29 closes the JSON::PP dependency without weakening trust
Package 15.10.32 adds JSON::PP to installer preflight and the os.pl runtime check while preserving the separation between system Perl, cPanel private Perl and explicit CPAN fallback.
Authenticated OS packages first
Outside cPanel, DCSF repairs the closed module list through exact RPM capabilities or Debian package mappings. DNF and YUM retain GPG verification, while APT rejects unauthenticated and insecure repositories.
Measured progress and re-verification
The installer inventories required modules before preflight and after repair. Attempts are bounded, must make measurable progress and succeed only when the entire closed list imports again.
CPAN only with explicit approval
The system CPAN fallback is disabled by default. The operator must pass --allow-cpan-fallback; DCSF uses a fixed HTTPS MetaCPAN mirror, closed module names and validated work directories.
cPanel private Perl boundary
On cPanel, DCSF always validates /usr/local/cpanel/3rdparty/bin/perl, derives the matching versioned cpanm and explicitly invokes it through that same private interpreter without mixing /usr/bin/perl libraries.
Required JSON::PP runtime
OLSPanel requires JSON::PP. RPM selects the signed perl(JSON::PP) capability, Debian selects libjson-pp-perl, cPanel uses private cpanm and system CPAN still requires explicit --allow-cpan-fallback.
Canary PASS: An earlier public --dryrun canary authenticated the release under test, selected the correct installer and left every regular file directly below /etc/csf byte-identical.
DCSF
DH20.29 keeps OLSPanel actions in the visible viewport
Package 15.10.32 bounds the iframe to 640–1,200 pixels, scrolls it internally and returns it to the top after navigation. The masked modal, Watch System Logs, Search for IP and Firewall Allow remain visible while trusted-policy and real-backend checks are retained.
Discovery without a false prerequisite
The modules directory is optional. Detection accepts only supported canonical roots and a safe root-owned /etc/olspanel/base_dir declaration.
Protected-configuration preflight
Before writing, the adapter only reads metadata for /etc/csf, /etc/csf/csf.conf and /etc/csf/csf.cloudflare. --dryrun executes the same checks without changing files.
Alias rejection and exact diagnostics
Symlinks, non-regular files, non-root ownership, group/world writable metadata and protected files with more than one hard link are rejected before installation with the exact failing path.
Content-preserving finalization
After installation, /etc/csf becomes root:root 0700 while csf.conf and csf.cloudflare become root:root 0600 with exactly one hard link. Existing contents remain byte-identical.
Authenticated missing file
If csf.cloudflare is missing, it may be installed only from the verified signed package; an existing file is not replaced.
No false success
The generic installer stops when recursive chmod or chown fails instead of continuing to a PASS message.
Controlled modules creation
A missing directory is created only during a real installation as root:root 0755. DCSF records privately that it created the path.
Conservative uninstall
Uninstall removes the parent only when DCSF created it and it remains empty. Foreign or non-empty content is preserved.
JSON::PP runtime dependency
Preflight and the os.pl runtime check require JSON::PP. Repair uses signed RPM capability perl(JSON::PP), Debian package libjson-pp-perl, cPanel private cpanm or the explicitly enabled system CPAN fallback.
Isolated backend compilation
After generic installation but before publishing or restarting panel integration, the adapter runs an isolated perl -T -c backend check. Failure stops OLSPanel integration.
Correct panel assets
OLSPanel serves images from the authenticated /usr/local/csf/lib/webmin/csf/images tree, where the signed package installs assets including csf.svg.
Explicit trusted policy
The backend loads /usr/local/csf/lib/ConfigServer/panel-action-policy.json with require_trusted => 1 instead of using the CyberPanel-specific default path. The complete parent chain and file must be root-controlled and non-writable by others.
Real backend-frame validation
The installer sends a bounded read-only binary request through the actual taint-mode backend. The response may not exceed 16 MiB and must contain the DCSF interface marker before integration is published or restarted. After the extmail.uck.katowice.pl upgrade, the complete Django-to-Perl-backend path returned HTTP 200.
Masked administrator reauthentication
Protected actions use a dedicated modal with a bounded type="password" field instead of window.prompt(). Escape, the cancel control and backdrop cancellation safely stop the operation, and the visible field is cleared immediately after the credential is handed to the request.
Working system-log tools
Search System Logs and Watch System Logs accept only a one-to-twenty digit nocache value. Progress ends after every response, failed requests display their HTTP status, and live search and watch checks returned HTTP 200.
Visible protected-action results
Intercepted navigation is deduplicated, deferred to the next event turn and explicitly submitted to _self with visible progress. Quick Allow and configuration save retain a complete nonempty response instead of an empty frame.
Search for IP and Firewall Allow
Tests through the real Perl backend found the newly added address, displayed the Firewall Allow list and returned normal Done and Return controls. The temporary entry was removed and the final csf.allow digest exactly matched its pre-test value.
Bounded scrollable action viewport
The action iframe stays between 640 and 1,200 pixels, scrolls long content internally and returns to the top after every navigation. The live test kept the outer page at 1,000 pixels with scroll position zero, so Search for IP, Firewall Allow, Watch System Logs and the reauthentication modal remained visible.
DCSF
Published fix-count comparison
The figures preserve each project’s published methodology. When a release maintainer has not disclosed a security-fix count, the table says so instead of inventing a value.
| Line and release | Explicitly counted security fixes | Other fixes or controls | Comparison evidence |
|---|---|---|---|
| DCSF DH20.29technical package 15.10.32 | 5151 of 51 individually documented and verified remediations | 3 controls + Perl + OLSPanel + WebGuardDH20.29 qualification: 77 of 77 gates | Public P-01–P-51 registerImplementation, regression test and release qualification |
| cPanel CSF 16.31-1cPanel & WHM-only release | Not disclosedThe maintainer did not publish a fix count for 16.31-1 | 16.30-1: 4 + 54 security fixes and 5 stability or compatibility fixes | Official cPanel change log16.31-1 is described as a Targeted Security Release |
| Aetherinox CSF 15.10public compatibility baseline | 2Items directly addressing XSS or untrusted-input encoding | 11 listed fix itemsTotal fixes in the public release summary | Official 15.10 release notesNo equivalent numbered security-remediation matrix |
DCSF: 13 September 2026; comparison sources: 10 September 2026. Methodology: DCSF counts independent security requirements closed by implementation and testing. For other releases, only figures explicitly published by their maintainers are shown. Fix items, security gates and CVE identifiers are not equivalent units.
DCSF
A hardened CSF/LFD firewall for hosting infrastructure
DCSF preserves the familiar CSF and LFD workflow while closing exploit classes around root execution, untrusted parsers, remote updates, panel authorisation and firewall state.
Verifiable updates
Release metadata binds version, package name and cryptographic digest to a pinned signing key.
Safer privileged work
Shell-free execution and explicit validation reduce ambiguity where firewall administration crosses privilege boundaries.
Bounded input handling
Network, file and log inputs are processed with size, time and structure limits.
Operational continuity
Changes are designed for staged validation, deterministic failure and recoverable firewall state.
Native OLSPanel integration
Closed authenticated actions, CSRF protection, password re-authentication and shell-free bounded execution protect the new panel path.
Hardened WebGuard
Bounded replay, audit and correlation detect per-vhost overload without placing foreign-owned web logs inside the LFD parser.
Refreshed operator interface
A compact header, readable status stack, clear controls, dark mode and responsive tables improve daily administration.
DCSF
DH20.29 WebGuard: bounded per-vhost web protection
This release retains caps on replay, audit volume and correlation cost, while an isolated service copies validated OpenLiteSpeed evidence. WebGuard runs outside the LFD regex parser and remains disabled in report mode by default.
Canonical vhosts and verified cPanel proxy
Adapters accept only canonical vhosts or configured aliases. In verified cPanel EA-Nginx, nginx on 80/443 supplies client IP; Apache on 81/444 supplies backend load, never the local proxy peer as a blocking candidate.
Hard replay ceilings
Replay accepts at most 50,000 input lines, 30 seconds and 2,000 emitted audit records, and reports whether the result is complete.
Bounded causal correlation
Audit buffers are capped, quadratic scans are avoided and out-of-order source timestamps cannot corrupt the rolling vhost window.
Isolated OpenLiteSpeed evidence
A root service copies only the validated OLS log into a 256 MiB-capped DCSF file rotated at 128 MiB, outside the foreign-owned log tree.
Safe by default
WEBGUARD=0 and WEBGUARD_MODE=report keep both the engine and optional collector disabled until an operator validates the evidence.
Bounded enforcement
Enforce mode can create only temporary exact-IP, inbound, listener-port-specific DCSF actions and protects allow, ignore, monitoring and trusted proxy or CDN ranges.
DCSF / CSF / LFD
Familiar CSF controls, substantially stronger boundaries
Administrators retain the recognisable CSF/LFD operational model in a refreshed responsive interface. DCSF adds signed distribution, strict validation, bounded processing, transactional recovery and report-first WebGuard correlation underneath it.
- Compact header and readable status stack
- Clear tabs, forms and tables
- Light and dark modes
- Responsive mobile actions
DCSF
One security layer across nine deployment paths
DCSF supports eight hosting-panel integrations, including a bounded OLSPanel action viewport, repaired authentication, logs and firewall workflows, cPanel private-Perl handling, plus a generic Linux mode for direct administration.
cPanel & WHM
Preserves WHM workflows and backup-first RPM migration. Verified EA-Nginx uses nginx on 80/443 for client IP and Apache on 81/444 for backend status. Dependency repair keeps /usr/local/cpanel/3rdparty/bin/perl separate from system Perl.
OLSPanel
Keeps the OLSPanel action iframe between 640 and 1,200 pixels with internal scrolling and top reset, so masked reauthentication, Watch System Logs, Search for IP and Firewall Allow remain visible.
DirectAdmin
Uses the established DirectAdmin adapter with hardened argument validation, identity transitions and shell-free privileged execution.
CyberPanel
Retains the CyberPanel integration while restricting privileged mutations to authenticated, CSRF-protected POST actions.
CWP
Supports the existing Control Web Panel administration path with the same signed package, parser limits and firewall-state safeguards.
InterWorx
Integrates with NodeWorx and enforces native FIREWALL authority, blocking secondary accounts that do not hold that permission.
VestaCP
Keeps the VestaCP CSF/LFD integration path while applying the common DCSF release, input-validation and recovery controls.
Webmin
Supports CSF/LFD administration through Webmin with the same hardened backend and signed update channel.
Generic Linux
Provides direct operation on supported RHEL- and Debian-family servers. Missing closed-list Perl modules are repaired through GPG-verified RPM capabilities or authenticated APT package mappings.
DCSF
Threat data is useful only when it is trustworthy
The DataHouse Threat Feed is continuously refreshed through a controlled pipeline designed to reject malformed, stale and duplicate records.
Collect
Receive indicators from curated operational and research sources.
Validate
Confirm syntax, address scope, provenance and transport integrity.
Normalise
Canonicalise records and eliminate duplicate or conflicting entries.
Age
Expire indicators whose confidence or operational relevance has decayed.
Released
DH20.29 is published
DH20.29 maps to signed package 15.10.32: validated WHM session context, bounded csf.temppids compaction, public-only cPanel META permissions, corrected reseller-file repair and equivalent nftables policy comparison. All 77 Linux test files passed and the autossltest2 canary update succeeded. DH20.28 is superseded. Optional AI System Scan, the LFD exclusion editor and public download resources are retained.
The signed public package and installer are available.
DCSF
Questions operators ask
Key information about the current production release.
What is AI System Scan?
An optional quick or deep security review of a bounded local snapshot. It is disabled by default and requires your own OpenAI API key. Results must reference supplied evidence IDs, remain advisory and do not automatically run repairs.
Is AI System Scan included in the free software price?
The DCSF software remains free under GPLv3, at USD 0. Optional OpenAI API usage is billed separately to the administrator’s API account. Selected diagnostic data is sent to OpenAI; store=false is not a Zero Data Retention guarantee.
Is DCSF the latest hardened CSF/LFD release from DataHouse?
Yes. DH20.29 is the latest hardened release in the DCSF line. It maps to signed technical package 15.10.32, carries 51 verified security remediations and passed all 77 release gates.
How does DH20.29 repair the required JSON::PP module?
RPM systems select the signed perl(JSON::PP) capability and Debian systems select libjson-pp-perl. cPanel uses its validated private Perl and matching cpanm; system CPAN remains disabled unless the operator explicitly supplies --allow-cpan-fallback.
How does DH20.29 load the OLSPanel action policy?
The backend uses the explicit shared path /usr/local/csf/lib/ConfigServer/panel-action-policy.json with require_trusted => 1. The complete parent chain and policy file must remain root-controlled and non-writable.
How does DH20.29 validate the real OLSPanel backend?
After generic installation and before publishing or restarting panel integration, the adapter runs perl -T -c and sends a bounded read-only binary request through the actual taint-mode backend. The response is limited to 16 MiB and must contain the DCSF interface marker.
How does DH20.29 protect administrator reauthentication?
Protected OLSPanel actions use a dedicated modal with a bounded type=password field instead of window.prompt(). Escape, cancellation and backdrop cancellation are supported, and the visible field is cleared immediately when the protected request receives the credential.
How does DH20.29 repair OLSPanel logs and action results?
Search System Logs and Watch System Logs accept only a one-to-twenty digit nocache value and always clear their progress state. Deferred, deduplicated _self navigation preserves results after Quick Allow, configuration save, Search for IP and Firewall Allow.
How does DH20.29 keep OLSPanel action results visible?
The action iframe stays between 640 and 1,200 pixels, scrolls internally and returns to its top after every navigation. Search for IP, Firewall Allow, Watch System Logs and the centered masked reauthentication modal therefore remain inside the visible operator viewport.
How does DH20.29 validate OLSPanel assets?
OLSPanel images, including csf.svg, are served from the authenticated package tree at /usr/local/csf/lib/webmin/csf/images.
How does DH20.29 protect OLSPanel CSF configuration?
Before package installation, the adapter performs a read-only metadata preflight for /etc/csf, /etc/csf/csf.conf and /etc/csf/csf.cloudflare. It rejects symlinks, unsafe hard links and unsafe metadata with an exact-path diagnostic, then normalizes the directory to root:root 0700 and protected files to root:root 0600 without changing existing contents.
Which control panels does DCSF support?
DCSF supports OLSPanel, cPanel & WHM, DirectAdmin, CyberPanel, CWP, InterWorx, VestaCP and Webmin, plus a generic mode for supported RHEL- and Debian-family Linux servers.
What bugs and exploit classes were fixed?
The public register covers command and argument injection, ReDoS and resource exhaustion, file races, update-chain substitution, web-panel abuse, cluster spoofing and replay, process identity bypasses, DNS trust errors and firewall-state loss.
What is WebGuard?
WebGuard is an optional, disabled-by-default service that correlates costly or stalled requests with saturation of the same canonical virtual host. DH20.29 retains bounded replay, isolated OpenLiteSpeed log collection and temporary exact-IP, listener-port-specific enforcement.
Can I download DCSF today?
Yes. DH20.29 is public and maps to the signed DCSF 15.10.32 package. The bootstrap verifies every trust-bearing artifact before installation.
How does the published fix count compare with cPanel CSF and Aetherinox CSF?
DCSF publishes 51 individually verified security remediations plus three operational controls. cPanel does not disclose a fix count for its targeted 16.31-1 security release. The Aetherinox 15.10 release summary lists 11 fix items, including two directly focused on XSS or unsafe input rendering; these release-note items are not equivalent to DCSF security gates.