[NiteWave]

run "top -c":

27128 root 20 0 111m 956 800 D 8.3 0.0 0:00.83 /bin/tar -rf /etc/csf/suspicious.tar /tmp/lshttpd/bak_core/core.16462

I killed the process by
#kill 27128

like I did last time. please see if email still coming in.

please try to upgrade to 4.2.2 manually. it fixed a few mod_security bugs and likely including yours.

#cd /usr/local/lsws/admin/misc
#./lsup.sh -v 4.2.2