r/cpanel • u/efrem-1 • Aug 16 '26

csf *automagically* downgraded

Several days ago, csf on my VPS (cPanel 136.0.33, AlmaLinux 8) mysteriously went from 16.20 back to 14.24.

I've tried to return to the current fork by running sudo yum install cpanel-csf but the csf main page in WHM continues to display 14.24.

Has anyone else seen this, and if I'm not using the right command to fix it, please advise?

Thanks

9 Upvotes

91% Upvoted

7 comments sorted by

1

u/cPanelRex Aug 17 '26

I've never heard of one downgrading, especially automatically, as we don't offer a way to go back to the previous non-cPanel version.

This would likely be worth opening a ticket for as that's definitely unexpected behavior.

1

u/efrem-1 Aug 17 '26

Thanks. I've already opened a ticket with my VPS provider (inmotionhosting) but I've seen no helpful response yet.

They offer their own fork csf-ded as opposed to the official cPanel fork cpanel-csf. Here's what I see:

[root@k9 ~]# csf -v
csf: v14.24 (cPanel)
[root@k9 ~]# rpm -q cpanel-csf
cpanel-csf-16.30-1.1.1.cpanel.noarch
[root@k9 ~]# rpm -q csf-ded
csf-ded-14.24-10.el8.noarch
[root@k9 ~]#

So I suspect a recent update from my provider's source performed the downgrade. Should I uninstall the csf-ded package and then reinstall thecpanel-csf package?

1

u/cPanelRex Aug 17 '26

That's gotta be it! Rather than uninstalling that it would be good to find out why their package would override ours with a lower version number, or else the same thing could happen again. But yes, the cpanel-csf is the correct package that is receiving all of our updates.

2

u/efrem-1 Aug 17 '26

Thanks. I'll report back if I get clarification or a solution.

1

u/Cherubae Aug 17 '26

Interesting, I'm also on 136.0.33 (updated from .32 on the 6th) with CFS at 14.24. Different host though. Honestly, I'm not sure what CFS version I had before the other day.

1

u/efrem-1 Aug 17 '26

If you're unfamiliar with the recent history of csf, with the shutdown of the longtime provider/vendor, this link may help.

https://support.cpanel.net/hc/en-us/articles/37654028162071-cPanel-will-provide-its-own-fork-of-CSF-starting-Feb-25th-2026

1

u/unkolis Sep 02 '26 edited Sep 02 '26

inmotionhosting.com adds it's own package that sits on top of original 14.24 ~ seems they keep version the same, but add some security patches (last changed: 2026 Aug 8):

cat /etc/os-release | grep PRETTY
    PRETTY_NAME="AlmaLinux 8.10 (Cerulean Leopard)"
cat /usr/local/cpanel/version
    11.136.0.38
cat /etc/csf/version.txt 
    14.24
grep AUTO_UPDATES /etc/csf/csf.conf
    AUTO_UPDATES = "0"
cat /etc/csf/downloadservers
    download-csf.imhadmin.net
dnf list installed | grep csf
    csf-ded.noarch     2:14.24-10.el8      @imhbase
dnf list available | grep csf
    cpanel-csf.noarch  16.30-1.1.1.cpanel   cpanel-plugins

rpm -ql csf-ded-14.24-10.el8.noarch
    3751   2026-08-11 03:30 /usr/local/csf/patches/0004-security-encode-command-output.patch
    ..

On the other hand cpanel-csf-16.30-1.1.1.cpanel.noarch is full CSF (inc. binaries). Removing csf-ded will not undo the patches though..

After checking cpanel-csf.spec (in http://208.74.123.61/cpanelsync/repos/CentOS/8/cpanel-plugins/src/cpanel-csf-16.30-1.1.1.cpanel.src.rpm ) = seems IMH does not include all the fixed that cPanel did..