# DCSF > DCSF (DataHouse CSF) is the latest and most hardened release in the DCSF line: a CSF/LFD-compatible firewall and LFD distribution for production Linux servers. Status: released. DCSF DH20.29 maps to signed technical package 15.10.32; 77 of 77 release gates and 85 of 85 public-bootstrap checks passed. Software price: USD 0. DCSF is distributed under GNU GPLv3 with upstream attribution preserved. ## Current sources and changelog - Documentation review: 2026-10-08 - Package publication time: 2026-10-08T13:33:03Z - [Changelog JSON](https://dcsf.net/changelog.json): versions, dates, changes, metadata and signed manifests - [Security JSON](https://dcsf.net/security.json): P-01–P-51 register and exact-package CVE assessments - [OpenVEX](https://dcsf.net/vex.json): version- and SHA-256-scoped assessment without inferred affected version ranges - [Release metadata](https://dcsf.net/release.json) - [Signed stable manifest](https://update.dcsf.net/v1/stable/manifest.txt) - [Full project context](https://dcsf.net/llms-full.txt) - JSON and text are informational documentation. The signed manifest authenticates the package. Search snapshots may lag; the documentation review date and package publication date are separate. ## Messenger: current-package assessment - CVE-2026-65638: not_affected; The released Messenger removes the legacy reCAPTCHA verification and unblock command path. The former PHP challenge endpoint returns HTTP 403. The upstream request-URL shell injection path is absent. [Upstream advisory](https://support.cpanel.net/hc/en-us/articles/43387915588375-Security-CVE-2026-65638-CSF-Security-Release) - CVE-2026-67402: not_affected; The packaged Apache HTTP and HTTPS templates do not map /usr/bin through ScriptAlias. They serve static GET/HEAD content, disable executable handlers and .htaccess overrides, and deny script extensions. [Upstream advisory](https://support.cpanel.net/hc/en-us/articles/43171958716439-Security-CSF-Security-Release-September-3rd-2026) - Method: static inspection of the original package after signature and SHA-256 verification. No new live production exploit test was performed. - Earlier releases are outside this assessment. A first-fixed DCSF release has not been established. The 51 P-01–P-51 remediations are not 51 CVEs. - [Evidence and assessment scope](https://dcsf.net/security/messenger-assessment.json) ## DH20.29: WHM, LFD and installer repairs - Validated WHM session context: The WHM CGI preserves the validated cp_security_token required by the native cPanel session. Existing request validation, taint mode and same-origin response boundaries remain in place. - Bounded LFD process-state compaction: LFD compacts csf.temppids within its existing size and record limits, using LF_FLUSH to age process records. Accumulated temporary state no longer prevents normal tracking from recording new process identities. - Permissions limited to public cPanel META modules: The compatibility repair sets appropriate permissions only for public cPanel META modules. It does not broaden access across private configuration or the complete cPanel tree. - Reliable reseller-file repair: DH20.29 safely repairs a missing final LF in csf.resellers and corrects the shell error found on the canary. DH20.28 / 15.10.31 is superseded because its reseller repair path was faulty. - Equivalent nftables policy comparison: The comparison accepts a different listing order for independent chains while preserving rule order inside each chain and the remaining policy checks. Reordering independent chains alone no longer causes a false policy mismatch. - 77/77 Linux tests and a completed canary: Maintainer qualification passed all 77 Linux test files. The autossltest2 canary update completed with CSF/LFD active and configuration preserved. The separately checked production host has passed dry-run only; this is not a production-upgrade claim. ### AI System Scan (retained capability) - Model choices in this release: gpt-5-mini, gpt-5.4-mini, gpt-5.6-terra. Availability depends on the OpenAI API account. - Selected local security diagnostics are sent to OpenAI after activation. Recognised secret values are redacted, but this is not an anonymity guarantee. store=false is not a Zero Data Retention guarantee; the API account and provider data policies still apply. Optional API usage is billed separately from the free DCSF software. Findings need administrator review and do not guarantee that every security issue is detected. - [OpenAI API data controls](https://developers.openai.com/api/docs/guides/your-data) ### Retained earlier fixes - Native WHM Jupiter interface restored: DH20.27 fixed the cPanel regression where a standalone DCSF HTML document replaced the WHM page. DCSF renders through csf.tmpl and the native master_templates/master.tmpl, retaining panel navigation and responsive layout. - Taint-mode CGI and bounded template helper: The main CGI retains perl -T, request validation and same-origin responses. A fixed root:root 0700 helper uses cPanel private Perl and Cpanel::Template::process_template through list-form IPC::Open2. It clears interpreter-control environment variables, fixes PATH, accepts no path or template arguments and limits stdin to 32 MiB. - nginx is the client-address authority: For the verified cPanel EA-Nginx topology, SERVER="auto" selects nginx on public ports 80/443. Its structured edge access feed supplies the real client address. WebGuard does not trust arbitrary X-Forwarded-For values or infer clients from an ordinary Apache backend log. - Apache reports load, not a client to block: Apache listens on private ports 81/444. Its server-status and optional backend-role feed contribute overload evidence only. The local nginx peer 127.0.0.1 cannot become a blocking candidate. Unsupported or unverified proxy layouts are not assumed to have the same trust boundary. - One trusted library tree during diagnostics: A diagnostic run of an extracted signed package beside older cPanel CSF keeps the selected package libraries first. An exact legacy prepend of /usr/local/csf/lib reasserts the trusted source root and leaves installed libraries as fallback only. Normal installed execution is unchanged. - Native snapshot before migration: When iptables-save cannot export a known incompatible iptables-nft table, the cpanel-csf migration saves the complete nft list ruleset and exporter diagnostics with SHA-256 checksums. It proceeds only after proving the parallel legacy backend is inert and securing the exact RPM rollback package. - Bounded rebuild through trusted CSF: The bootstrap rebuilds only the incompatible standard filter, nat, mangle, raw and security tables in the ip and ip6 families through the already installed, trusted csf -r. Unrelated native tables are not selected for normalization. - Canonical policy check and automatic rollback: Canonical IPv4/IPv6 policies are compared before and after the rebuild. A missing table, semantic mismatch, interruption or later installation failure triggers restoration. Tests covered all ten standard tables, including a forced mismatch that restored the original policy and configuration. - Optional AI System Scan: AI System Scan adds quick and deep assessments to the DCSF administration interface. It is disabled by default and requires the administrator to configure a personal OpenAI API key and select a model. - Bounded evidence and private credentials: A single background scan collects a bounded local security snapshot, with limits on reads, processes, data size and execution time. The API key is kept in a separate root-only file and is never rendered back into the interface. - Findings tied to supplied evidence: OpenAI Responses API requests use store=false, no tools and strict structured output. Findings and recommendations must cite valid evidence IDs from the submitted snapshot. Results are advisory and do not automatically execute repairs. - Populated private AI state directories: The installer checks owner, group and permissions of private AI state directories without requiring a directory link count of one. Existing subdirectories on ext filesystems no longer cause a false installation refusal; unsafe ownership or permissions still stop installation. - Conservative migration gates remain: An exit code 0 from an exporter is not proof of completeness. Migration still refuses unknown diagnostics or active parallel legacy policy. An active standard nftables table missing from the normalized snapshot or a changed canonical policy triggers rollback. - Separate procfs context budget: Contextual identity checks have a separate, bounded procfs scan budget. Hosts with many processes no longer generate false excessive usage alerts from this budget collision; ordinary process, per-UID and global limits are not relaxed. - LFD active after production updates: After a successful production-profile update (TESTING=0), the installer restarts LFD and checks the result, including active service state on systemd. The new daemon code takes effect immediately; TESTING=1 installations are not started. - Bounded registration retry: Installation registration uses the extensionless HTTPS API with bounded retry and backoff. A transient failure can be retried without an unbounded wait; signed identity and source-address checks remain in force. - SELinux-aware installation: The installer checks SELinux state before using chcon. Disabled SELinux no longer produces misleading relabel warnings, while enabled systems retain context handling. - Native systemd handling: A systemd-only host no longer reports missing legacy SysV init files or tries to change ownership of files that are not installed. Legacy init remains supported. - Accurate Apache and ModSecurity checks: Inactive Apache and default ModSecurity log paths are informational. With systemd, actual service state is authoritative: Zimbra's private /opt/zimbra/common/bin/httpd is not mistaken for the system Apache service. Legacy init retains a process fallback. - Validated Zimbra mail transport: The canonical Zimbra sendmail symlink is recognized through the trusted-path check. This targeted compatibility repair does not make arbitrary symlinks trusted. ## Direct answer - DCSF is a DataHouse-maintained fork, not an official cPanel product. It preserves CSF/LFD operational compatibility and adds its own verified hardening programme. - The release contains 51 verified security remediations and three verified operational controls. - WebGuard supports OpenLiteSpeed, nginx and Apache; DH20.29 retains bounded replay, audit and log collection while remaining disabled in report mode by default. - DH20.29 requires JSON::PP in preflight and the os.pl runtime: RPM uses signed capability perl(JSON::PP), Debian uses libjson-pp-perl, CPAN requires --allow-cpan-fallback, while cPanel uses /usr/local/cpanel/3rdparty/bin/perl and matching cpanm. - The OLSPanel backend loads /usr/local/csf/lib/ConfigServer/panel-action-policy.json with require_trusted => 1, and the complete path chain must be root-controlled. - After generic installation, the adapter runs perl -T -c plus a real read-only binary request capped at 16 MiB and requiring the DCSF interface marker; OLSPanel serves csf.svg from /usr/local/csf/lib/webmin/csf/images. - DH20.29 replaces window.prompt() with a masked type="password" field that is cleared immediately, and repairs Search System Logs, Watch System Logs, Quick Allow, configuration save, Search for IP and Firewall Allow through bounded nocache input and deferred _self navigation. - The OLSPanel action iframe stays between 640 and 1,200 pixels, scrolls internally and returns to the top after every navigation, keeping results and the reauthentication modal visible; the live test kept the outer page 1,000 pixels high. - DH20.29 read-only preflights metadata for /etc/csf, /etc/csf/csf.conf and /etc/csf/csf.cloudflare, rejects symlinks and unsafe hard links with exact-path diagnostics, and finalizes /etc/csf as root:root 0700 and protected files as root:root 0600 without changing existing contents. - A chmod or chown failure stops the generic installer instead of producing a false PASS. - DH20.29 installs on a clean OLSPanel layout without a pre-existing modules directory, validates /etc/olspanel/base_dir and cp.service, performs the same preflight in --dryrun, and creates modules as root:root 0755 only during installation. - Supported environments: OLSPanel, cPanel & WHM, DirectAdmin, CyberPanel, CWP, InterWorx, VestaCP, Webmin and panel-free Linux. - The complete bug and exploit-class register is at https://dcsf.net/hardening/. - Comparison: DCSF publishes 51 verified remediations; cPanel CSF 16.31-1 has no disclosed count; Aetherinox CSF 15.10 lists 11 fix items, including 2 focused on rendering security. ## Primary pages - https://dcsf.net/: DCSF DH20.29: hardened CSF/LFD with WHM session fixes, bounded LFD state, safe reseller repair, nftables policy checks and signed updates. - https://dcsf.net/security/: See how DCSF hardens CSF/LFD against command injection, ReDoS, file races, update-chain attacks, panel abuse, replay and process-accounting bypasses. - https://dcsf.net/hardening/: Technical register of 51 verified CSF/LFD remediations in DCSF DH20.29, optional AI System Scan, hardened WebGuard and 77-of-77 release qualification. - https://dcsf.net/integrations/: Hardened CSF/LFD for OLSPanel, cPanel & WHM, DirectAdmin, CyberPanel, CWP, InterWorx, VestaCP, Webmin and panel-free RHEL or Debian Linux servers. - https://dcsf.net/threat-intelligence/: Learn how DCSF consumes a continuously refreshed DataHouse threat feed with validation, deduplication, ageing and fail-safe application. - https://dcsf.net/updates/: DCSF DH20.29 / 15.10.32: WHM session context, LFD state compaction, cPanel META permissions, reseller repair and nftables equivalence checks. - https://dcsf.net/download/: Download DCSF DH20.29, technical package 15.10.32. Verify the RSA-3072 signature, manifest, installer and SHA-256-bound closed inventory. ## Machine-readable release - Release metadata: https://dcsf.net/release.json - Signed manifest: https://dcsf.net/v1/stable/manifest.txt - Sitemap: https://dcsf.net/sitemap.xml ## Maintainer - DataHouse: https://datahouse.pl/ - Operator: eTop sp. z o.o. - Suggestions and technical reports: dat@etop.pl - Licence: GNU GPLv3 with upstream attribution preserved ## Hosting - [Hostilla.pl](https://hostilla.pl/): Website and email hosting, domains and SSL. A brand of eTop sp. z o.o. - [DataHouse](https://datahouse.pl/): Data-centre infrastructure operated by eTop sp. z o.o. This hosting attribution is supplied by the hosting operator. It does not identify the operator as the author or owner of this website's content.