Validated WHM session context
The WHM CGI preserves the validated cp_security_token required by the native cPanel session. Existing request validation, taint mode and same-origin response boundaries remain in place.
Updates
Signed releases, pinned trust and controlled rollback
DH20.29 / 15.10.32 preserves validated WHM session context, compacts bounded LFD process state and limits permission repair to public cPanel META modules. It corrects the reseller-file shell error found on canary and compares equivalent nftables policies despite reordered independent chains. DH20.28 is superseded; migration safeguards and rollback are retained.
DCSF
Current release and security status
DH20.29 / 15.10.32. Published: 2026-10-08T13:33:03Z. Documentation reviewed: 2026-10-08.
The 51 P-01–P-51 identifiers describe internal remediations, not 51 assigned CVEs. Static Messenger notices are supported; legacy reCAPTCHA self-unblock is disabled.
CVE-2026-65638 / CVE-2026-67402: exact-package assessment
This assessment applies only to the authentic reviewed package and its managed templates. It does not assess every installation or guarantee the absence of every vulnerability. Earlier releases are not assigned a status without separate verification.
Changelog JSON | Security JSON | OpenVEX | llms.txt | llms-full.txt
DCSF
DH20.29: what changed
This release combines WHM context, LFD state and installer repairs with the regression fix found on canary. It supersedes DH20.28; the 51-item security register remains a separate count, without counting tests as vulnerabilities.
Bounded LFD process-state compaction
LFD compacts csf.temppids within its existing size and record limits, using LF_FLUSH to age process records. Accumulated temporary state no longer prevents normal tracking from recording new process identities.
Permissions limited to public cPanel META modules
The compatibility repair sets appropriate permissions only for public cPanel META modules. It does not broaden access across private configuration or the complete cPanel tree.
Reliable reseller-file repair
DH20.29 safely repairs a missing final LF in csf.resellers and corrects the shell error found on the canary. DH20.28 / 15.10.31 is superseded because its reseller repair path was faulty.
Equivalent nftables policy comparison
The comparison accepts a different listing order for independent chains while preserving rule order inside each chain and the remaining policy checks. Reordering independent chains alone no longer causes a false policy mismatch.
77/77 Linux tests and a completed canary
Maintainer qualification passed all 77 Linux test files. The autossltest2 canary update completed with CSF/LFD active and configuration preserved. The separately checked production host has passed dry-run only; this is not a production-upgrade claim.
Models, data and API costs
Model choices offered by this release: gpt-5-mini, gpt-5.4-mini, gpt-5.6-terra. Availability depends on the administrator’s OpenAI API account.
Selected local security diagnostics are sent to OpenAI after activation. Recognised secret values are redacted, but this is not an anonymity guarantee. store=false is not a Zero Data Retention guarantee; the API account and provider data policies still apply. Optional API usage is billed separately from the free DCSF software. Findings need administrator review and do not guarantee that every security issue is detected.
Retained installation and compatibility fixes
- Native WHM Jupiter interface restored. DH20.27 fixed the cPanel regression where a standalone DCSF HTML document replaced the WHM page. DCSF renders through csf.tmpl and the native master_templates/master.tmpl, retaining panel navigation and responsive layout.
- Taint-mode CGI and bounded template helper. The main CGI retains perl -T, request validation and same-origin responses. A fixed root:root 0700 helper uses cPanel private Perl and Cpanel::Template::process_template through list-form IPC::Open2. It clears interpreter-control environment variables, fixes PATH, accepts no path or template arguments and limits stdin to 32 MiB.
- nginx is the client-address authority. For the verified cPanel EA-Nginx topology, SERVER="auto" selects nginx on public ports 80/443. Its structured edge access feed supplies the real client address. WebGuard does not trust arbitrary X-Forwarded-For values or infer clients from an ordinary Apache backend log.
- Apache reports load, not a client to block. Apache listens on private ports 81/444. Its server-status and optional backend-role feed contribute overload evidence only. The local nginx peer 127.0.0.1 cannot become a blocking candidate. Unsupported or unverified proxy layouts are not assumed to have the same trust boundary.
- One trusted library tree during diagnostics. A diagnostic run of an extracted signed package beside older cPanel CSF keeps the selected package libraries first. An exact legacy prepend of /usr/local/csf/lib reasserts the trusted source root and leaves installed libraries as fallback only. Normal installed execution is unchanged.
- Native snapshot before migration. When iptables-save cannot export a known incompatible iptables-nft table, the cpanel-csf migration saves the complete nft list ruleset and exporter diagnostics with SHA-256 checksums. It proceeds only after proving the parallel legacy backend is inert and securing the exact RPM rollback package.
- Bounded rebuild through trusted CSF. The bootstrap rebuilds only the incompatible standard filter, nat, mangle, raw and security tables in the ip and ip6 families through the already installed, trusted csf -r. Unrelated native tables are not selected for normalization.
- Canonical policy check and automatic rollback. Canonical IPv4/IPv6 policies are compared before and after the rebuild. A missing table, semantic mismatch, interruption or later installation failure triggers restoration. Tests covered all ten standard tables, including a forced mismatch that restored the original policy and configuration.
- Optional AI System Scan. AI System Scan adds quick and deep assessments to the DCSF administration interface. It is disabled by default and requires the administrator to configure a personal OpenAI API key and select a model.
- Bounded evidence and private credentials. A single background scan collects a bounded local security snapshot, with limits on reads, processes, data size and execution time. The API key is kept in a separate root-only file and is never rendered back into the interface.
- Findings tied to supplied evidence. OpenAI Responses API requests use store=false, no tools and strict structured output. Findings and recommendations must cite valid evidence IDs from the submitted snapshot. Results are advisory and do not automatically execute repairs.
- Populated private AI state directories. The installer checks owner, group and permissions of private AI state directories without requiring a directory link count of one. Existing subdirectories on ext filesystems no longer cause a false installation refusal; unsafe ownership or permissions still stop installation.
- Conservative migration gates remain. An exit code 0 from an exporter is not proof of completeness. Migration still refuses unknown diagnostics or active parallel legacy policy. An active standard nftables table missing from the normalized snapshot or a changed canonical policy triggers rollback.
- Separate procfs context budget. Contextual identity checks have a separate, bounded procfs scan budget. Hosts with many processes no longer generate false excessive usage alerts from this budget collision; ordinary process, per-UID and global limits are not relaxed.
- LFD active after production updates. After a successful production-profile update (TESTING=0), the installer restarts LFD and checks the result, including active service state on systemd. The new daemon code takes effect immediately; TESTING=1 installations are not started.
- Bounded registration retry. Installation registration uses the extensionless HTTPS API with bounded retry and backoff. A transient failure can be retried without an unbounded wait; signed identity and source-address checks remain in force.
- SELinux-aware installation. The installer checks SELinux state before using chcon. Disabled SELinux no longer produces misleading relabel warnings, while enabled systems retain context handling.
- Native systemd handling. A systemd-only host no longer reports missing legacy SysV init files or tries to change ownership of files that are not installed. Legacy init remains supported.
- Accurate Apache and ModSecurity checks. Inactive Apache and default ModSecurity log paths are informational. With systemd, actual service state is authoritative: Zimbra's private /opt/zimbra/common/bin/httpd is not mistaken for the system Apache service. Legacy init retains a process fallback.
- Validated Zimbra mail transport. The canonical Zimbra sendmail symlink is recognized through the trusted-path check. This targeted compatibility repair does not make arbitrary symlinks trusted.
Linux release qualification: 77/77. Public-bootstrap checks: 85/85.
DCSF
DH20.29 closes the JSON::PP dependency without weakening trust
Package 15.10.32 adds JSON::PP to installer preflight and the os.pl runtime check while preserving the separation between system Perl, cPanel private Perl and explicit CPAN fallback.
Authenticated OS packages first
Outside cPanel, DCSF repairs the closed module list through exact RPM capabilities or Debian package mappings. DNF and YUM retain GPG verification, while APT rejects unauthenticated and insecure repositories.
Measured progress and re-verification
The installer inventories required modules before preflight and after repair. Attempts are bounded, must make measurable progress and succeed only when the entire closed list imports again.
CPAN only with explicit approval
The system CPAN fallback is disabled by default. The operator must pass --allow-cpan-fallback; DCSF uses a fixed HTTPS MetaCPAN mirror, closed module names and validated work directories.
cPanel private Perl boundary
On cPanel, DCSF always validates /usr/local/cpanel/3rdparty/bin/perl, derives the matching versioned cpanm and explicitly invokes it through that same private interpreter without mixing /usr/bin/perl libraries.
Required JSON::PP runtime
OLSPanel requires JSON::PP. RPM selects the signed perl(JSON::PP) capability, Debian selects libjson-pp-perl, cPanel uses private cpanm and system CPAN still requires explicit --allow-cpan-fallback.
Canary PASS: An earlier public --dryrun canary authenticated the release under test, selected the correct installer and left every regular file directly below /etc/csf byte-identical.
DCSF
DH20.29 keeps OLSPanel actions in the visible viewport
Package 15.10.32 bounds the iframe to 640–1,200 pixels, scrolls it internally and returns it to the top after navigation. The masked modal, Watch System Logs, Search for IP and Firewall Allow remain visible while trusted-policy and real-backend checks are retained.
Discovery without a false prerequisite
The modules directory is optional. Detection accepts only supported canonical roots and a safe root-owned /etc/olspanel/base_dir declaration.
Protected-configuration preflight
Before writing, the adapter only reads metadata for /etc/csf, /etc/csf/csf.conf and /etc/csf/csf.cloudflare. --dryrun executes the same checks without changing files.
Alias rejection and exact diagnostics
Symlinks, non-regular files, non-root ownership, group/world writable metadata and protected files with more than one hard link are rejected before installation with the exact failing path.
Content-preserving finalization
After installation, /etc/csf becomes root:root 0700 while csf.conf and csf.cloudflare become root:root 0600 with exactly one hard link. Existing contents remain byte-identical.
Authenticated missing file
If csf.cloudflare is missing, it may be installed only from the verified signed package; an existing file is not replaced.
No false success
The generic installer stops when recursive chmod or chown fails instead of continuing to a PASS message.
Controlled modules creation
A missing directory is created only during a real installation as root:root 0755. DCSF records privately that it created the path.
Conservative uninstall
Uninstall removes the parent only when DCSF created it and it remains empty. Foreign or non-empty content is preserved.
JSON::PP runtime dependency
Preflight and the os.pl runtime check require JSON::PP. Repair uses signed RPM capability perl(JSON::PP), Debian package libjson-pp-perl, cPanel private cpanm or the explicitly enabled system CPAN fallback.
Isolated backend compilation
After generic installation but before publishing or restarting panel integration, the adapter runs an isolated perl -T -c backend check. Failure stops OLSPanel integration.
Correct panel assets
OLSPanel serves images from the authenticated /usr/local/csf/lib/webmin/csf/images tree, where the signed package installs assets including csf.svg.
Explicit trusted policy
The backend loads /usr/local/csf/lib/ConfigServer/panel-action-policy.json with require_trusted => 1 instead of using the CyberPanel-specific default path. The complete parent chain and file must be root-controlled and non-writable by others.
Real backend-frame validation
The installer sends a bounded read-only binary request through the actual taint-mode backend. The response may not exceed 16 MiB and must contain the DCSF interface marker before integration is published or restarted. After the extmail.uck.katowice.pl upgrade, the complete Django-to-Perl-backend path returned HTTP 200.
Masked administrator reauthentication
Protected actions use a dedicated modal with a bounded type="password" field instead of window.prompt(). Escape, the cancel control and backdrop cancellation safely stop the operation, and the visible field is cleared immediately after the credential is handed to the request.
Working system-log tools
Search System Logs and Watch System Logs accept only a one-to-twenty digit nocache value. Progress ends after every response, failed requests display their HTTP status, and live search and watch checks returned HTTP 200.
Visible protected-action results
Intercepted navigation is deduplicated, deferred to the next event turn and explicitly submitted to _self with visible progress. Quick Allow and configuration save retain a complete nonempty response instead of an empty frame.
Search for IP and Firewall Allow
Tests through the real Perl backend found the newly added address, displayed the Firewall Allow list and returned normal Done and Return controls. The temporary entry was removed and the final csf.allow digest exactly matched its pre-test value.
Bounded scrollable action viewport
The action iframe stays between 640 and 1,200 pixels, scrolls long content internally and returns to the top after every navigation. The live test kept the outer page at 1,000 pixels with scroll position zero, so Search for IP, Firewall Allow, Watch System Logs and the reauthentication modal remained visible.
Released
DH20.29 is published
DH20.29 maps to signed package 15.10.32: validated WHM session context, bounded csf.temppids compaction, public-only cPanel META permissions, corrected reseller-file repair and equivalent nftables policy comparison. All 77 Linux test files passed and the autossltest2 canary update succeeded. DH20.28 is superseded. Optional AI System Scan, the LFD exclusion editor and public download resources are retained.
The signed public package and installer are available.
DCSF
Current release identity
The DataHouse public number remains operator-facing, while the technical version preserves compatibility with the CSF/LFD update mechanism.
| Public release | DH20.29 |
|---|---|
| Technical version | 15.10.32 |
| Security remediations | 51 of 51 verified |
| Perl dependencies | JSON::PP through perl(JSON::PP), libjson-pp-perl, cPanel private cpanm or explicit --allow-cpan-fallback |
| OLSPanel policy | /usr/local/csf/lib/ConfigServer/panel-action-policy.json loaded explicitly with require_trusted => 1 |
| OLSPanel backend | perl -T -c plus a real read-only binary frame bounded to 16 MiB and the DCSF interface marker |
| OLSPanel reauthentication | masked type="password" field without window.prompt(), with Escape, cancellation and immediate visible-field clearing |
| OLSPanel system logs | Search System Logs and Watch System Logs end progress for every response and allow only a one-to-twenty digit nocache value |
| OLSPanel action results | deferred _self navigation preserves responses for Quick Allow, configuration save, Search for IP and Firewall Allow |
| OLSPanel action viewport | iframe bounded from 640 to 1,200 pixels, internal scrolling and return to the top after every navigation |
| OLSPanel assets | /usr/local/csf/lib/webmin/csf/images with the signed csf.svg icon |
| OLSPanel | clean layout, safe base_dir and read-only /etc/csf metadata preflight |
| Configuration finalization | /etc/csf root:root 0700; csf.conf and csf.cloudflare root:root 0600; contents preserved byte-for-byte |
| Installer integrity | symlinks and unsafe hard links rejected with the exact path; chmod or chown failure stops installation |
| WebGuard | hard replay and audit ceilings, isolated OLS collector, disabled by default |
| Release qualification | 77 of 77 gates |
| Public bootstrap | 85 of 85 checks |
| Stable channel | update.dcsf.net/v1/stable/ |
DCSF
Release channel design
The update client separates checking, downloading and applying, allowing operators to inspect each stage.
Check
Fetch signed metadata from the fixed DCSF update origin without inheriting ambient proxy settings.
Verify
Validate the manifest signature, version policy, package name, digest and archive structure.
Stage
Extract into a private location and run release and compatibility checks before activation.
Apply
Activate only an accepted candidate and preserve a controlled rollback path.
DCSF
Operator workflow
The installed client checks, downloads and applies a signed release from the pinned channel as separate operations.
dcsf-update check
dcsf-update download
dcsf-update applyThe signed public package and installer are available. manifest.txt · manifest.txt.sig · release.json
Stable channel metadata · Versioned release metadata 15.10.32. release.json is informational. Package authenticity is established by the signed manifest, pinned key and checksums.
DCSF
Release changelog
12 recent releases verified against signed manifests. This is a bounded history, not the complete project archive.
DH20.29 / 15.10.32 (current)
- Validated WHM session context. The WHM CGI preserves the validated cp_security_token required by the native cPanel session. Existing request validation, taint mode and same-origin response boundaries remain in place.
- Bounded LFD process-state compaction. LFD compacts csf.temppids within its existing size and record limits, using LF_FLUSH to age process records. Accumulated temporary state no longer prevents normal tracking from recording new process identities.
- Permissions limited to public cPanel META modules. The compatibility repair sets appropriate permissions only for public cPanel META modules. It does not broaden access across private configuration or the complete cPanel tree.
- Reliable reseller-file repair. DH20.29 safely repairs a missing final LF in csf.resellers and corrects the shell error found on the canary. DH20.28 / 15.10.31 is superseded because its reseller repair path was faulty.
- Equivalent nftables policy comparison. The comparison accepts a different listing order for independent chains while preserving rule order inside each chain and the remaining policy checks. Reordering independent chains alone no longer causes a false policy mismatch.
- 77/77 Linux tests and a completed canary. Maintainer qualification passed all 77 Linux test files. The autossltest2 canary update completed with CSF/LFD active and configuration preserved. The separately checked production host has passed dry-run only; this is not a production-upgrade claim.
DH20.28 / 15.10.31
- Validated WHM session context. The WHM CGI preserves the validated cp_security_token required by the native cPanel session. Existing request validation, taint mode and same-origin response boundaries remain in place.
- Bounded LFD process-state compaction. LFD compacts csf.temppids within its existing size and record limits, using LF_FLUSH to age process records. Accumulated temporary state no longer prevents normal tracking from recording new process identities.
- Permissions limited to public cPanel META modules. The compatibility repair sets appropriate permissions only for public cPanel META modules. It does not broaden access across private configuration or the complete cPanel tree.
- Superseded reseller repair. DH20.28 introduced a missing-LF repair for csf.resellers, but canary testing found a shell error in that path. Use DH20.29 / 15.10.32, which replaces this release.
DH20.27 / 15.10.30
- Native WHM Jupiter interface restored. DH20.27 fixed the cPanel regression where a standalone DCSF HTML document replaced the WHM page. DCSF renders through csf.tmpl and the native master_templates/master.tmpl, retaining panel navigation and responsive layout.
- Taint-mode CGI and bounded template helper. The main CGI retains perl -T, request validation and same-origin responses. A fixed root:root 0700 helper uses cPanel private Perl and Cpanel::Template::process_template through list-form IPC::Open2. It clears interpreter-control environment variables, fixes PATH, accepts no path or template arguments and limits stdin to 32 MiB.
- Verified release without firewall-policy changes. Release qualification passed 1,533 assertions in 77 Linux test files. Canary and production upgrades preserved selected operator configuration and normalized IPv4/IPv6 policies; CSF/LFD remained active and enabled. Authenticated WHM and Playwright checks covered desktop 1440 and mobile 390 pixel viewports. WebGuard remains disabled by default.
DH20.26 / 15.10.29
- nginx is the client-address authority. For the verified cPanel EA-Nginx topology, SERVER="auto" selects nginx on public ports 80/443. Its structured edge access feed supplies the real client address. WebGuard does not trust arbitrary X-Forwarded-For values or infer clients from an ordinary Apache backend log.
- Apache reports load, not a client to block. Apache listens on private ports 81/444. Its server-status and optional backend-role feed contribute overload evidence only. The local nginx peer 127.0.0.1 cannot become a blocking candidate. Unsupported or unverified proxy layouts are not assumed to have the same trust boundary.
- One trusted library tree during diagnostics. A diagnostic run of an extracted signed package beside older cPanel CSF keeps the selected package libraries first. An exact legacy prepend of /usr/local/csf/lib reasserts the trusted source root and leaves installed libraries as fallback only. Normal installed execution is unchanged.
DH20.25 / 15.10.28
- Verified cPanel EA-Nginx proxy detection. WebGuard recognizes a bounded, root-owned cPanel EA-Nginx configuration with nginx on public ports 80/443 and Apache on private ports 81/444. Automatic request authority selects the nginx edge feed.
- Private Apache status and backend-only evidence. The protected Apache status broker prefers the private Apache listener. Apache server-status and an optional backend feed supply saturation evidence, not client identity; the local proxy peer cannot become a firewall candidate.
DH20.24 / 15.10.27
- Native snapshot before migration. When iptables-save cannot export a known incompatible iptables-nft table, the cpanel-csf migration saves the complete nft list ruleset and exporter diagnostics with SHA-256 checksums. It proceeds only after proving the parallel legacy backend is inert and securing the exact RPM rollback package.
- Bounded rebuild through trusted CSF. The bootstrap rebuilds only the incompatible standard filter, nat, mangle, raw and security tables in the ip and ip6 families through the already installed, trusted csf -r. Unrelated native tables are not selected for normalization.
- Canonical policy check and automatic rollback. Canonical IPv4/IPv6 policies are compared before and after the rebuild. A missing table, semantic mismatch, interruption or later installation failure triggers restoration. Tests covered all ten standard tables, including a forced mismatch that restored the original policy and configuration.
DH20.23 / 15.10.26
- Populated private AI state directories. The installer checks owner, group and permissions of private AI state directories without requiring a directory link count of one. Existing subdirectories on ext filesystems no longer cause a false installation refusal; unsafe ownership or permissions still stop installation.
DH20.22 / 15.10.25
- Optional AI System Scan. AI System Scan adds quick and deep assessments to the DCSF administration interface. It is disabled by default and requires the administrator to configure a personal OpenAI API key and select a model.
- Bounded evidence and private credentials. A single background scan collects a bounded local security snapshot, with limits on reads, processes, data size and execution time. The API key is kept in a separate root-only file and is never rendered back into the interface.
- Findings tied to supplied evidence. OpenAI Responses API requests use store=false, no tools and strict structured output. Findings and recommendations must cite valid evidence IDs from the submitted snapshot. Results are advisory and do not automatically execute repairs.
DH20.21 / 15.10.24
- Exporter warnings stop migration. The migration bootstrap refuses to continue when iptables-save returns exit code 0 but its diagnostics report an incompatible nft table. A successful exit status alone is not accepted as proof of a complete firewall export.
- Mixed and omitted firewall state is refused. Migration is refused when legacy and nft rules coexist, or when an active standard nftables table is omitted from the export. An incomplete snapshot cannot silently become the rollback baseline.
- Complete, checksum-bound migration evidence. The migration backup saves the full nft list ruleset output and exporter diagnostics. These files are included in the backup SHA-256 checksums so the captured rules and export evidence can be verified together.
DH20.20 / 15.10.23
- LFD active after production updates. After a successful production-profile update (TESTING=0), the installer restarts LFD and checks the result, including active service state on systemd. The new daemon code takes effect immediately; TESTING=1 installations are not started.
DH20.19 / 15.10.22
- Separate procfs context budget. Contextual identity checks have a separate, bounded procfs scan budget. Hosts with many processes no longer generate false excessive usage alerts from this budget collision; ordinary process, per-UID and global limits are not relaxed.
DH20.18 / 15.10.21
- Accurate systemd Apache detection for Zimbra. Systemd service state is authoritative for Apache and ModSecurity log checks. A private Zimbra httpd process does not make an inactive system Apache appear active. The legacy init process fallback is retained.