{
  "schema": "dcsf-messenger-source-assessment-v1",
  "assessedAt": "2026-10-08T13:46:20.628Z",
  "publicRelease": "DH20.29",
  "technicalVersion": "15.10.32",
  "artifactSha256": "ba8e5a738dec83bf4ef3abd8b59add85e88f495555f5dd8f116d837b70f86268",
  "sourceCommit": "784481c2223e709ec9ab0a3e9bcc8cc41071293f",
  "manifest": "https://update.dcsf.net/releases/15.10.32/manifest.txt",
  "method": "Fresh pinned-key signature, artifact digest and complete inventory verification. Six reviewed Messenger sources and Apache templates remain byte-identical. LFD matches the signed-package source commit; its complete diff from the previously reviewed source changes only three LF_FLUSH arguments in process tracking, outside Messenger and the retired unblock queue. Not a new live exploit test.",
  "scope": "Authentic, unmodified release package and its managed templates. This does not attest to a particular server installation, residual administrator configuration, every vulnerability, or earlier DCSF releases.",
  "historicalReleaseStatus": "not_assessed",
  "files": {
    "ConfigServer/Messenger.pm": "a10163e7bf4d94f9da7c6aa3e811e0d6601a75332d7b114575dad87a2d47e518",
    "lfd.pl": "0fbf9135c97cff92c52be8f1edae70c8deef92dfd47aac39ec3711a1a9472e84",
    "apache.main.txt": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "apache.http.txt": "dec5decf8df5485e365a1646e289bfdf75f7c3a3d87ab56e48600c256ca9a98f",
    "apache.https.txt": "125f62739b053e50a6b539d6b2f507b7284035470ff604699c3313074449812c",
    "messenger/index.recaptcha.php": "e0b2b66cbb28aa18f55b4a4fe63f71ea78b76027998e107faa9519c02917f029",
    "messenger/index.recaptcha.html": "30528973dd77e8fe5e1da21bad5390dff933f7e799a121f4c197f78824bd6390"
  },
  "checks": [
    {
      "id": "captcha-secret-retired",
      "passed": true,
      "description": "Messenger removes the legacy reCAPTCHA secret from its process configuration."
    },
    {
      "id": "captcha-execution-path-absent",
      "passed": true,
      "description": "The Messenger module has no legacy provider verification or root-command transport path."
    },
    {
      "id": "captcha-php-disabled",
      "passed": true,
      "description": "The former PHP challenge endpoint returns HTTP 403 without command or provider transport."
    },
    {
      "id": "legacy-root-queue-absent",
      "passed": true,
      "description": "LFD no longer consumes the legacy reCAPTCHA unblock command queue."
    },
    {
      "id": "apache.main.txt-no-bin-cgi",
      "passed": true,
      "description": "The packaged Apache configuration has no /usr/bin CGI mapping."
    },
    {
      "id": "apache.http.txt-no-bin-cgi",
      "passed": true,
      "description": "The packaged Apache configuration has no /usr/bin CGI mapping."
    },
    {
      "id": "apache.https.txt-no-bin-cgi",
      "passed": true,
      "description": "The packaged Apache configuration has no /usr/bin CGI mapping."
    },
    {
      "id": "apache.http.txt-static-only",
      "passed": true,
      "description": "The packaged vhost serves static GET/HEAD content with overrides and executable handlers disabled."
    },
    {
      "id": "apache.http.txt-script-types-denied",
      "passed": true,
      "description": "The vhost explicitly denies executable filename extensions."
    },
    {
      "id": "apache.https.txt-static-only",
      "passed": true,
      "description": "The packaged vhost serves static GET/HEAD content with overrides and executable handlers disabled."
    },
    {
      "id": "apache.https.txt-script-types-denied",
      "passed": true,
      "description": "The vhost explicitly denies executable filename extensions."
    }
  ],
  "advisories": [
    {
      "id": "CVE-2026-65638",
      "source": "https://cveawg.mitre.org/api/cve/CVE-2026-65638",
      "references": [
        "https://support.cpanel.net/hc/en-us/articles/43387915588375-Security-CVE-2026-65638-CSF-Security-Release"
      ],
      "sourceUpdated": "2026-09-10T18:19:18.373Z"
    },
    {
      "id": "CVE-2026-67402",
      "source": "https://cveawg.mitre.org/api/cve/CVE-2026-67402",
      "references": [
        "https://support.cpanel.net/hc/en-us/articles/43171958716439-Security-CSF-Security-Release-September-3rd-2026"
      ],
      "sourceUpdated": "2026-09-04T19:47:36.330Z"
    }
  ]
}