CSF alerts 'suspicious directory' after Webmin update

SYSTEM INFORMATION
OS type and version AlmaLinux 8.10
Webmin version 2.652
Usermin version 2.551
Virtualmin version 8.1.0 GPL
Theme version 26.50.3
Apache version 2.4.37
Package updates All installed packages are up to date

Hello,

It seems after the recent update to webmin which I did on July 18 2026 at 12:25 AM, on the 22nd, I started receiving email alerts from CSF about a ‘Suspicious-directory’ in the /tmp directory. The directory is:

/tmp/.webmin-0-root

I’m assuming this is just a false positive but I thought I would make sure since there is already a .webmin directory in /tmp which I believe is used by webmin during updating, etc. Just seemed odd for another webmin related directory to appear out of nowhere a few days later.

Any insight is appreciated! Thank you!

You’re right, this CSF warning is a false positive and can be ignored.