NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

LiteSpeed cPanel plugin symlink flaw CVE-2026-54420 exploited to take over shared hosting servers

Attackers used a LiteSpeed cPanel plugin flaw to gain full control of shared hosting servers. If you own a hosted website, ask your host to confirm cPanel plugin 2.4.8 or later is installed and check for compromise.

What to do

If you have a website on shared hosting, ask your host to update LiteSpeed’s WHM plugin to 5.3.2.1 or later and confirm the bundled cPanel plugin is at least 2.4.8. Ask them to check LiteSpeed’s published log indicators for past compromise. If they cannot update, LiteSpeed recommends removing the user-end plugin.

What’s happening

CVE-2026-54420 mishandles symbolic links, which point to other files. It lets someone with FTP or web shell access gain root, the server’s highest level of control, on shared hosting running CloudLinux/CageFS. LiteSpeed says every user-end cPanel plugin version before 2.4.8 is affected and confirmed active exploitation when it disclosed the flaw on 1 June. MITRE records attacks in May, and CISA listed it on 15 June. The fix is available: cPanel identifies WHM bundle 5.3.2.0 as fixed, while LiteSpeed recommends 5.3.2.1 or later; both contain cPanel plugin 2.4.8. The latest listed bundle is 5.3.6.0. As of 3 November, the reviewed sources do not establish how many servers were compromised or whether attacks have stopped.

What
Flaw
Affects
LiteSpeed user-end plugin for cPanel
Affected
LiteSpeed user-end cPanel plugin versions before 2.4.8 on shared hosting servers running CloudLinux/CageFS
Fixed in
LiteSpeed user-end cPanel plugin 2.4.8
LiteSpeed WHM plugin 5.3.2.1 or later, the bundle recommended by LiteSpeed
CVE
CVE-2026-54420
Since
1 June 2026
Closed
22 Sept 2026

Timeline

  1. Update

    LiteSpeed released WHM plugin 5.3.6.0 with cPanel plugin 2.4.10.0. These are the newest versions shown in its release log reviewed for this record.

  2. CISA added

    CISA added CVE-2026-54420 to its Known Exploited Vulnerabilities catalogue, according to the CISA data reproduced by OpenCVE.

  3. Update

    MITRE published CVE-2026-54420 with a high-severity score of 8.5. The record says the flaw had been exploited in May.

  4. New fixFixed

    LiteSpeed disclosed active exploitation and released cPanel plugin 2.4.8. Its advisory recommends WHM plugin 5.3.2.1 or later, which bundles the fix.

  5. UpdateNo fix yet

    Namecheap alerted LiteSpeed to the flaw. LiteSpeed says cPanel pushed a command to uninstall the affected user-end plugin that day.

Sources

  1. Security Update for LiteSpeed cPanel PluginLiteSpeed Technologies · 1 June 2026
  2. Security: LiteSpeed cPanel Plugin - May 31, 2026cPanel · 1 June 2026
  3. Control Panel Plugins Release LogLiteSpeed Technologies · 22 Sept 2026
  4. CVE Record: CVE-2026-54420MITRE · 14 June 2026
  5. CVE-2026-54420 — CVE and CISA enrichment recordsOpenCVE · 16 June 2026
  6. CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege EscalationThe Hacker News · 16 June 2026
  7. LiteSpeed cPanel plugin flaws let any hosting account take over the serverSentilio · 22 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from June 2026 · JSON · RSS