It was discovered that Django did not vary cached response headers on cookies when sessions were not modified while SESSION_SAVE_EVERY_REQUEST was enabled. A remote attacker could possibly use this issue to steal a user's session. (CVE-202…
Security and maintenance updates We released updated packages for EasyApache 4. This security release updates ea-apache24 to 2.4.67, addressing 11 CVEs including an important remote code execution vulnerability (CVE-2026-23918 in mod_http2…
Managesieve LFD alert fix Added managesieve-login to csf.pignore to prevent excessive LFD resource alerts triggered by the Dovecot managesieve plugin (CPANEL-52448). For a full list of changes, read the ConfigServer Security & Firewall…
LFD startup and detection fixes Fixed multiple LFD issues: brute-force IMAP/POP3 login failure detection on Dovecot 2.4, LFD not starting after cPanel version upgrades, firewall rules failing to load after package upgrades, and LFD startup…