Security CSF Firewall v16.31 Security Update For Centmin Mod

Centmin Mod's forked CSF package has been updated to 16.31, and it's now live on the Centmin Mod mirror. This one's a security-focused release - it brings the security fixes from cPanel CSF Fork (16.20 and 16.30-1), adapted and tested for Centmin Mod. There's also additional features and fixes unique to Centmin Mod CSF Firewall fork.

Centmin Mod maintains a CSF Firewall fork mirror since August 25, 2026 after original CSF Firewall developers shutdown. If you are on Centmin Mod 132.00stable, 140.00beta01, 141.00beta01 and updated Centmin Mod since August 1, 2026 via cmupdate, you would of automatically been switched to Centmin Mod CSF Firewall mirror fork and started receiving automatically daily update checks which would of auto updated you to CSF Firewall v16.31+ - currently latest is v16.32. If you are on older Centmin Mod versions, read how to update to 132.00stable, 140.00beta01 here https://community.centminmod.com/th...ase-with-almalinux-rocky-linux-support.25572/.

The security vulnerabilities could allow an attacker to gain root user access to the server

CSF daily auto update should also update your server automatically. If not see below for manual update command. To confirm check the version:

Code (Text):

csf -v

Code (Text):

csf -v
csf: v16.31 (generic)

What's new

• Safer auto-updates - csf -u now checks the downloaded package against the mirror's published SHA256 checksum before installing anything, and bails out cleanly on a failed or partial download. TLS certificate verification is enforced on all mirror fetches.
• New: downgrade support - csf -ud rolls you back to the previous release (15.02) whenever you need it, using the same verified download. Handy if you want to sit out an update, or revert quickly after upgrading.
  Code (Text):

  csf --help
  
         -u,  --update
                Check for updates to csf and upgrade if available
  
         -uf    Force an update of csf whether and upgrade is required or not
  
         -ud    Downgrade csf to the previous release (e.g. roll back to the
                last known-good version) using the mirror's /csf-previous/ path.
                The downloaded package is SHA256-verified before install, like -u
  

• Smoother boot recovery - if the saved firewall rules can't be restored at boot - say, a ruleset saved by an older version - csf now rebuilds the full ruleset from your configuration during that same boot. The firewall comes up complete; no second reboot, no manual restart. This is new in 16.31: in original CSF 15.00 and Centmin Mod CSF forked 15.02 and the cPanel 16.30-1 fork, a failed restore at boot went silently unnoticed, leaving the firewall incomplete with no warning. 16.31 reports the problem and recovers from it in the same boot.
• Updated defaults - the Apache server-status check now points at the current status URL instead of a legacy cPanel-era alias. Only relevant if you run cPanel with Centmin Mod CSF Firewall v16.31+ forked version.
• Hardened reCAPTCHA / unblock handling - only relevant if you use the Messenger unblock page, which is off by default (MESSENGER = "0" in csf.conf) on Centmin Mod installs. If you enable it on an nginx + PHP-FPM (non-suexec) setup, set MESSENGER_USER and MESSENGERV3GROUP in /etc/csf/csf.conf to your PHP pool user and group - for default Centmin Mod installs that's nginx/nginx.

How to update

Code (Text):

csf -u

Need to roll back & downgrade to previous CSF version?

Code (Text):

csf -ud

---

 

If you SSH log in to your server, you would also have a MOTD (message of the day) notice for CSF Firewall version update like

Code (Text):

===============================================================================
 Centmin Mod 141.00beta01 — up to date
 CSF    15.02 → 16.31 available — run csf -u
===============================================================================

 

FAQ

1. Are these issues exploitable remotely, or only by someone with local access?

Yes - some of the issues could be triggered without any local access, which is why they were treated as critical. Some vulnerabilities might not apply to Centmin Mod default CSF installed configuration unless specific CSF config file /etc/csf/csf.conf settings are enabled by users after Centmin Mod installation of CSF. However, all security vulnerabilities are fixed in Centmin Mod CSF v16.31+

 

Centmin Mod CSF Firewall v16.32 follow up release for AlmaLinux/Rocky Linux 10 Kernel related fix that prevents fresh CSF Firewall v16.31 and earlier installs.

EL10 OSes' kernel-modules-extra YUM page auto-install

EL10 and later moved the iptables modules nft_compat, xt_conntrack and xt_multiport out of the base kernel package into kernel-modules-extra, which fresh installs do not ship - without them iptables cannot load any rule and csf failed to start with install advice (see example).

CSF now detects the missing modules at start (boot via --initup and csf -s/-r) and automatically installs the pinned kernel-modules-extra package for the running kernel via dnf, bounded by a 180s timeout and retried at most once per 24 hours, so a fresh EL10 server's first start loads its ruleset with no manual step.

Example of CSF Firewall v16.32 auto installing missing YUM package when detected missing. Centmin Mod code level also has auto install for missing YUM package for optimal coverage.

Code (Text):

systemctl status csf
● csf.service - ConfigServer Firewall & Security - csf
     Loaded: loaded (/usr/lib/systemd/system/csf.service; enabled; preset: disabled)
     Active: active (exited) since Fri 2026-08-07 15:08:00 GMT; 9min ago
 Invocation: 9cd815603e164be09a5f56ab744db6d4
   Main PID: 1087 (code=exited, status=0/SUCCESS)
   Mem peak: 464.8M
        CPU: 6.023s

Aug 07 15:07:55 localhost.localdomain csf[1391]: Transaction test succeeded.
Aug 07 15:07:55 localhost.localdomain csf[1391]: Running transaction
Aug 07 15:07:55 localhost.localdomain csf[1391]:   Preparing        :                                                        1/1
Aug 07 15:07:55 localhost.localdomain csf[1391]:   Installing       : kernel-modules-extra-6.12.0-211.43.1.el10_2.x86_64     1/1
Aug 07 15:08:00 localhost.localdomain csf[1391]:   Running scriptlet: kernel-modules-extra-6.12.0-211.43.1.el10_2.x86_64     1/1
Aug 07 15:08:00 localhost.localdomain csf[1391]: Installed:
Aug 07 15:08:00 localhost.localdomain csf[1391]:   kernel-modules-extra-6.12.0-211.43.1.el10_2.x86_64
Aug 07 15:08:00 localhost.localdomain csf[1391]: Complete!
Aug 07 15:08:00 localhost.localdomain csf[1087]: (restoring ipsets) (restoring iptables) (restoring ip6tables)
Aug 07 15:08:00 localhost.localdomain systemd[1]: Finished csf.service - ConfigServer Firewall & Security - csf.

Code (Text):

csf -v
csf: v16.32 (generic)

 

CSF Firewall v16.33 beta release is out for users to provide longer term testing and feedback on dev/non-production servers. If you want to help test the next release before it goes stable and auto updates on all Centmin Mod users, you can read https://community.centminmod.com/threads/centmin-mod-csf-firewall-v16-33-beta-release.32544/.