Have your host check your their mod_security settings... if they haven't updated, they are probably running outdated config file that seems to block XF's css.php
(if I remember correctly).
This was an issue several weeks ago... and if I was on a host that was THAT far behind keeping their mod_security config's up to date... I'd be rather concerned.