LiteSpeed cPanel Plugin 0

Cybersecuritynews •Abinaya • June 16, 2026

A critical zero-day vulnerability in the LiteSpeed cPanel user-end plugin is being actively exploited in the wild, posing a serious threat to shared hosting environments worldwide. The flaw, tracked as CVE-2026-54420, enables privilege escalation to root level, allowing attackers to take full control of affected servers under specific conditions. LiteSpeed cPanel Plugin Zero-Day Vulnerability According […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Issues Urgent Warning on Actively Exploited LiteSpeed cPanel Plugin Vulnerability The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a critical vulnerability (CVE-2026-54420) in the LiteSpeed cPanel user-end plugin, which allows attackers with FTP or web shell access to escalate privileges to root on shared hosting servers using CloudLinux/CageFS. This vulnerability, reported by Namecheap, is actively being exploited, prompting CISA to mandate that federal agencies secure their systems within three days. The flaw affects all versions prior to 2.4.8 of the plugin, which has been patched in the latest release. Users are advised to run specific commands to check for exploitation and examine system logs for any suspicious activity. The vulnerability was added to CISA's Known Exploited Vulnerabilities Catalog on June 15, 2026, following its public disclosure on June 14, 2026. This situation highlights the ongoing risks associated with privilege escalation vulnerabilities in widely used software. 5 sources 73

Extracted Entities

LiteSpeed cPanel Plugin 0

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)