Store Index

store.litespeedtech.com • September 15, 2026

Share: View original

[Security] Block setting of important internal-use environment variables from .htaccess.

[Feature] Enable post-quantum cryptography key exchange.

[Improvement] Add support for the MKCALENDAR request method.

[Bug fix] Address a race condition corner case for ModSecurity engine.

[Bug fix] Address an internal URL cache corner case.

[Bug fix] Improve Node.js process management to avoid lingering idle workers.

[Bug fix] Address HTTP/3 idle connection timeout issue.

[Bug fix] Address a namespace issue for natively configured vhost.

[Bug fix] Address a corner case in SHM locking.

Please remember, there may be some delay between this announcement and the ability to auto-update. If you don't want to wait, you can update manually via the following command: `/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7`

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical LiteSpeed Web Server Vulnerability Allows Root Access via Shared Hosting Accounts A critical vulnerability in LiteSpeed Web Server Enterprise allows low-privilege users on shared hosting servers to gain root access, potentially compromising other accounts and the server itself. The flaw affects versions prior to 6.3.7, and cPanel issued an advisory on September 14, 2026, urging immediate updates. This vulnerability bypasses account isolation controls, including CageFS, which restricts user access to their own files. As of September 15, 2026, the latest stable version is still listed as 6.3.6, and administrators are advised to manually update to 6.3.7. There is currently no CVE identifier associated with this vulnerability, and it is unclear if it has been exploited in the wild. This incident marks the third critical flaw related to LiteSpeed software on cPanel servers since May 2026. Administrators are encouraged to run a specific command to update their installations promptly. 2 sources 71

Store Index

The full story

Extracted Entities

Platforms (1)

Tools (1)