{"id":"litespeed-cpanel-symlink-attacks-jun-2026","category":"patch","status":"closed","title":"LiteSpeed cPanel plugin symlink flaw CVE-2026-54420 exploited to take over shared hosting servers","tldr":"Attackers used a LiteSpeed cPanel plugin flaw to gain full control of shared hosting servers. If you own a hosted website, ask your host to confirm cPanel plugin 2.4.8 or later is installed and check for compromise.","summary":"CVE-2026-54420 mishandles symbolic links, which point to other files. It lets someone with FTP or web shell access gain root, the server’s highest level of control, on shared hosting running CloudLinux/CageFS. LiteSpeed says every user-end cPanel plugin version before 2.4.8 is affected and confirmed active exploitation when it disclosed the flaw on 1 June. MITRE records attacks in May, and CISA listed it on 15 June. The fix is available: cPanel identifies WHM bundle 5.3.2.0 as fixed, while LiteSpeed recommends 5.3.2.1 or later; both contain cPanel plugin 2.4.8. The latest listed bundle is 5.3.6.0. As of 3 November, the reviewed sources do not establish how many servers were compromised or whether attacks have stopped.","action":"If you have a website on shared hosting, ask your host to update LiteSpeed’s WHM plugin to 5.3.2.1 or later and confirm the bundled cPanel plugin is at least 2.4.8. Ask them to check LiteSpeed’s published log indicators for past compromise. If they cannot update, LiteSpeed recommends removing the user-end plugin.","product":"LiteSpeed user-end plugin for cPanel","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-54420"],"tags":["litespeed","cpanel","shared-hosting","linux","privilege-escalation","actively-exploited"],"affected":["LiteSpeed user-end cPanel plugin versions before 2.4.8 on shared hosting servers running CloudLinux/CageFS"],"fixed":["LiteSpeed user-end cPanel plugin 2.4.8","LiteSpeed WHM plugin 5.3.2.1 or later, the bundle recommended by LiteSpeed"],"matches":[],"sources":[{"kind":"advisory","title":"Security Update for LiteSpeed cPanel Plugin","url":"https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/","by":"LiteSpeed Technologies","date":"2026-06-01"},{"kind":"advisory","title":"Security: LiteSpeed cPanel Plugin - May 31, 2026","url":"https://support.cpanel.net/hc/en-us/articles/40868195661207-Security-LiteSpeed-cPanel-Plugin-May-31-2026","by":"cPanel","date":"2026-06-01"},{"kind":"advisory","title":"Control Panel Plugins Release Log","url":"https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/release-log","by":"LiteSpeed Technologies","date":"2026-09-22"},{"kind":"advisory","title":"CVE Record: CVE-2026-54420","url":"https://www.cve.org/CVERecord?id=CVE-2026-54420","by":"MITRE","date":"2026-06-14"},{"kind":"advisory","title":"CVE-2026-54420 — CVE and CISA enrichment records","url":"https://opencve.alliance.unm.edu/cve/CVE-2026-54420","by":"OpenCVE","date":"2026-06-16"},{"kind":"news","title":"CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation","url":"https://thehackernews.com/2026/06/cisa-flags-litespeed-cpanel-plugin-flaw.html","by":"The Hacker News","date":"2026-06-16"},{"kind":"research","title":"LiteSpeed cPanel plugin flaws let any hosting account take over the server","url":"https://www.sentilio.io/vulnerabilities/litespeed-cpanel-plugin-cve-2026-48172","by":"Sentilio","date":"2026-10-22"}],"started":"2026-06-01","closed":"2026-09-22","created":"2026-11-03T22:25:06.810Z","updated":"2026-11-03T22:25:06.810Z","cve_notes":[{"cve":"CVE-2026-54420","name":"Symlink privilege escalation in LiteSpeed cPanel plugin","what":"Incorrect handling of symbolic links in LiteSpeed’s user-end cPanel plugin lets someone with FTP or web shell access gain full administrator control of a shared hosting server running CloudLinux/CageFS.","severity":"high","cvss":8.5}],"timeline":[{"at":"2026-09-22","added":"2026-11-03T22:22:59.664Z","kind":"other","text":"LiteSpeed released WHM plugin 5.3.6.0 with cPanel plugin 2.4.10.0. These are the newest versions shown in its release log reviewed for this record.","url":"https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/release-log","by":"LiteSpeed Technologies","patch":null},{"at":"2026-06-15","added":"2026-11-03T22:22:59.664Z","kind":"cisa-added","text":"CISA added CVE-2026-54420 to its Known Exploited Vulnerabilities catalogue, according to the CISA data reproduced by OpenCVE.","url":"https://opencve.alliance.unm.edu/cve/CVE-2026-54420","by":"OpenCVE","patch":null},{"at":"2026-06-14","added":"2026-11-03T22:22:59.664Z","kind":"other","text":"MITRE published CVE-2026-54420 with a high-severity score of 8.5. The record says the flaw had been exploited in May.","url":"https://www.cve.org/CVERecord?id=CVE-2026-54420","by":"MITRE","patch":null},{"at":"2026-06-01","added":"2026-11-03T22:22:59.664Z","kind":"new-fix","text":"LiteSpeed disclosed active exploitation and released cPanel plugin 2.4.8. Its advisory recommends WHM plugin 5.3.2.1 or later, which bundles the fix.","url":"https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/","by":"LiteSpeed Technologies","patch":"patched"},{"at":"2026-05-31","added":"2026-11-03T22:22:59.664Z","kind":"other","text":"Namecheap alerted LiteSpeed to the flaw. LiteSpeed says cPanel pushed a command to uninstall the affected user-end plugin that day.","url":"https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/","by":"LiteSpeed Technologies","patch":"none"}],"url":"https://hard.fyi/live/litespeed-cpanel-symlink-attacks-jun-2026/","json":"https://hard.fyi/api/live?id=litespeed-cpanel-symlink-attacks-jun-2026"}