Updated 7 November 2026: CSF 2.3.2 security update.
Our own security audit of CSF 2.3 found and fixed issues in the web interface and in the malware quarantine, including a critical one: a crafted file name could run a script in the administrator’s firewall interface. Please update every server running CSF 2.3.0 or 2.3.1 with csf --self-update or the Update tab. Details are in the changelog.
csf --self-update.CSF is the firewall and intrusion-prevention system we build for our own servers and share with everyone as free software. It keeps the workflow server administrators have known for years from ConfigServer Security & Firewall – the csf command and the csf.conf, csf.allow and csf.deny files – and rebuilds the foundation on native nftables, with first-class IPv6, an event-driven LFD 2.0 and live Threat Intelligence. It is part of UnderShield, our protection and monitoring platform.
What’s new in CSF 2.3
- A new name: Core Shield Firewall. CSF is no longer a cPanel-only firewall, so the “C” now stands for Core. It is still called CSF, and it has a refreshed logo.
- cPanel, CloudPanel and no panel, one code base. The installer detects the platform and opens the right ports. On cPanel you get the WHM plugin; on CloudPanel and plain Linux you get a standalone web interface protected by a password and two-factor authentication. On CloudPanel the installer can publish it on your own HTTPS domain.
- Malicious upload scanning. Every 5 minutes, website files that changed are scanned with ClamAV (with the R-fx Networks Linux Malware Detect signatures) and YARA. Malware is moved to quarantine, and its uploader is blocked for 24 hours. You can restore or delete quarantined files with one click.
- LFD reads the systemd journal. Debian 12 and 13 no longer write
/var/log/auth.log, so brute-force detection now also reads the journal when needed. - The administrator is never locked out (2.3.1). The installer adds the IP address of your SSH session to the allow list, and the malware scanner never blocks an allow-listed IP or a signed-in administrator.
Malicious upload scanning
Most hacked websites start with one uploaded file: a web shell hidden in an uploads folder, a fake image with PHP inside, a backdoor dropped through a vulnerable plugin. CSF 2.3 watches for exactly that. It scans only files that changed since the last run, so even servers with thousands of sites stay fast, and it uses signatures built for web malware rather than desktop viruses.
When a file matches a known web-malware signature, CSF moves it to a quarantine where it cannot run, and blocks the IP address that uploaded it when the FTP or web server log names one clear address. Findings from the built-in checks that are only suspicious are logged, never acted on, so legitimate files are not removed by mistake. Turn it on with one command:
csf --scan-setup # installs ClamAV + YARA, downloads signatures, turns scanning on csf --scan-status # engines, signatures and last scan
Important fixes: update every CSF 2.x server
CSF 2.1 and 2.2 did not start the firewall after a reboot.
A start-up ordering problem made the system skip the firewall service at boot, so a rebooted server ran without CSF rules and without brute-force detection until someone restarted them. CSF 2.3 fixes this. Update your servers, then check with csf --selftest.
While testing 2.3 on ten Linux distributions, we also fixed:
- Longer blocks for repeat attackers now really last longer. The first, short block used to stay in place, so an attacker could come back after five minutes.
- LFD never blocks the server’s own IP addresses.
- AlmaLinux and CloudLinux 8 with SELinux: the services are now installed with the correct security labels.
- Minimal server images: the installer adds missing Perl modules and nftables itself, and warns when ufw or firewalld is active.
Tested on ten Linux distributions
Every system below got a clean install, the firewall enforcing, a real SSH brute-force attack and a reboot, before the release.
| System | Control panel |
|---|---|
| AlmaLinux 8, 9 and 10 | cPanel & WHM, CloudPanel or none |
| CloudLinux 9 and Rocky Linux 9 | cPanel & WHM or none |
| Ubuntu 22.04, 24.04 and 26.04 LTS | CloudPanel or none |
| Debian 12 and 13 | CloudPanel or none |
Install or update
Already running CSF 2.x? Open the Update tab in the interface, or run csf --self-update. The updater verifies the package checksum and keeps your configuration and lists.
New install (as root):
curl -fSLO https://shield.underhost.com/firewall/download/csf-2.3.2.tar.gz curl -fSLO https://shield.underhost.com/firewall/download/csf-2.3.2.tar.gz.sha256 sha256sum -c csf-2.3.2.tar.gz.sha256 tar xzf csf-2.3.2.tar.gz cd csf2 && sh install.sh
CSF installs in a safe testing mode first. When you have checked the ports in /etc/csf/csf.conf, turn protection on with csf --safe-reload, which rolls back automatically unless you confirm. Step-by-step guides: CSF on a server without a control panel and CSF on CloudPanel. Full documentation is on shield.underhost.com/firewall.
Open source on GitHub
CSF is free software under the GNU GPL v3. The source code, every release with its checksum, the changelog and the issue tracker are public at github.com/UnderHost/csf. You can read the code before you install it, report a bug, suggest a feature or send a pull request.
Protect your server with CSF
Download CSF 2.3.2 for free, or run it on an UnderHost VPS or dedicated server with our team behind you.
Frequently asked questions
Is CSF free?
Yes. CSF – Core Shield Firewall is free and open source under the GNU GPL v3, with the source code on GitHub.
Can I use CSF without cPanel?
Yes. Since 2.3, CSF runs on CloudPanel and on Linux servers with no control panel, with its own web interface protected by two-factor authentication.
Can I replace ConfigServer CSF with it?
Yes. The installer detects ConfigServer CSF v15 and the cPanel-maintained CSF, migrates your settings and allow and deny lists, and removes the old version.
How do I update from CSF 2.1 or 2.2?
Use the Update tab in the interface or run csf –self-update. Your configuration and lists are kept.
Does the malware scanner work with Imunify360?
When Imunify360 is installed, CSF leaves upload scanning to it and stays on stand-by, so the two never scan the same files twice. You can still turn CSF scanning on if you want both.
