Loading story…
cPanel warned that an undisclosed critical privilege-escalation flaw in LiteSpeed Web Server Enterprise before version 6.3.7 could allow a low-privilege shared-hosting account to bypass tenant-isolation controls, including CloudLinux CageFS, and obtain root access to the host. Successful exploitation could expose other customers’ websites, server configuration, and the underlying shared server.
LiteSpeed released version 6.3.7, and cPanel urged administrators to install it manually because automatic-update availability may be delayed. No CVE, severity score, technical root cause, workaround, indicators of compromise, or confirmed exploitation status has been published; the advisory applies to the Enterprise edition, while exposure of OpenLiteSpeed and 6.4.0 release candidates remains unconfirmed.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
cPanel issued a security notice warning that LiteSpeed Web Server Enterprise versions before 6.3.7 contain a critical flaw that could let a low-privileged shared-hosting user bypass isolation controls, including CloudLinux CageFS, and obtain root access. It urged administrators to manually install version 6.3.7 because automatic-update availability could be delayed.
LiteSpeed released Web Server Enterprise version 6.3.7, which cPanel identified as the remediation version for a critical privilege-escalation issue affecting earlier Enterprise versions.
LiteSpeed made a 6.4.0 RC1 prerelease available. The later cPanel notice did not establish whether 6.4.0 release candidates were affected by the Enterprise privilege-escalation flaw.
LiteSpeed disclosed a second actively exploited root-access vulnerability in its cPanel end-user plugin, among CVE-2026-48172 and CVE-2026-54420. The company patched the vulnerability in the plugin.
LiteSpeed disclosed one of two actively exploited root-access vulnerabilities affecting its cPanel end-user plugin, later identified collectively with CVE-2026-48172 and CVE-2026-54420. LiteSpeed patched the issue in the plugin.
CISA subsequently added CVE-2026-48172 and CVE-2026-54420, the actively exploited LiteSpeed cPanel end-user plugin vulnerabilities, to its Known Exploited Vulnerabilities catalog.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
mkd-cirt.mk
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
LiteSpeed disclosed and patched **CVE-2026-54420**, a high-severity privilege-escalation flaw in the LiteSpeed cPanel plugin that can let a low-privileged user gain **root** access on shared hosting servers. The bug affects plugin versions before **2.4.8** and stems from improper handling of user-supplied symlinks, a weakness classified as **`CWE-61`**. The issue is especially dangerous on **CloudLinux/CageFS** shared hosting deployments, where a single compromised tenant with FTP or web-shell access could potentially jeopardize other hosted sites on the same server. The vulnerability has been reported as **actively exploited in the wild**, with exploitation observed in May 2026, and carries a **CVSS 8.5** severity rating. LiteSpeed said the fix is included in cPanel plugin version **2.4.8**, bundled with **WHM Plugin v5.3.2.1**, and urged administrators to upgrade immediately or temporarily remove the user-end plugin if patching is not yet possible. Defenders were also advised to review cPanel logs for suspicious activity, including repeated requests to certificate-related endpoints from a single IP address.
Jun 29, 2026
A privilege-escalation vulnerability tracked as **`CVE-2026-48172`** affects the LiteSpeed User-End cPanel Plugin in versions before **`2.4.5`** and was reportedly exploited in the wild. The flaw is tied to improper handling of Redis enable/disable functionality and could allow an attacker to escalate privileges, potentially reaching **root** access. The related **LiteSpeed WHM Plugin** was identified as the parent plugin but was not affected. In response, cPanel said the LiteSpeed plugin was automatically removed during a nightly update, indicating active mitigation for affected environments. Defenders were advised to review cPanel log directories for requests containing: ```text cpanel_jsonapi_func=redisAble ``` and to investigate associated IP addresses and broader system logs to determine whether exploitation attempts or successful compromise occurred.
Jun 29, 2026
A **critical vulnerability** in the LiteSpeed Cache plugin for WordPress can let attackers create new user accounts — including **administrator** accounts — on affected sites, potentially leading to full site takeover. The issue affects **unpatched versions prior to `6.4`** when the plugin is deployed on **Linux-based systems**; based on available information, the flaw is **not currently believed to be exploitable on Windows-based deployments**. The plugin developer has released a fix in **version `6.4`**, and authorities urged organizations and individuals using WordPress with LiteSpeed Cache to update immediately because **no alternative mitigations are available**. While exploitation of this specific flaw had **not been observed** at the time of reporting, prior vulnerabilities in the same product have been **widely exploited**, increasing the urgency of patching exposed sites.
Jun 29, 2026