Why this one is different
Most advisories we publish concern software you run yourself. This one concerns the machine underneath a shared hosting account — and it inverts the trust model that shared hosting is sold on. The premise of shared hosting is that accounts are neighbours who cannot reach each other. CloudLinux and CageFS exist to enforce exactly that. This flaw lets one neighbour with nothing more than an FTP account walk out of their box and become root on the host. At that point every site on the server is readable, writable, and modifiable by someone who paid for the cheapest plan on it.The flaw
The plugin mishandles symbolic links. An account with FTP or web shell access can plant a symlink that the plugin follows while running with elevated rights, and use that to escalate to root. No exploit of a memory bug, no race against a kernel. Just a privileged process trusting a path that an unprivileged user controls — the oldest shape of local privilege escalation there is, and still one of the most effective. Two properties make it serious rather than merely interesting: The entry bar is low. FTP access is the least-privileged thing a shared host hands out. It is what every customer gets, including the one who bought a plan with a stolen card an hour ago. It is confirmed exploited. CISA does not add flaws to KEV on theory. The catalog entry, dated 15 June 2026, means it has been used against real systems. The issue was reported by Namecheap on 31 May 2026 — a hosting provider finding it in its own fleet, which tells you something about where it shows up.Sizing your exposure
Worth separating two things that share a name. This is a flaw in the cPanel plugin distributed by LiteSpeed, not in LiteSpeed Web Server itself. If you run LSWS on a VPS you manage alone, without cPanel, you are not in scope.
Checking and updating
Check the installed plugin version from WHM, or on the command line:Looking for signs it was used
Patching stops it happening again; it says nothing about the past. Because exploitation is confirmed in the wild, a server that ran a vulnerable version deserves a look. The tell is a burst of plugin calls in quick succession — the exploit needs several concurrent attempts to win. In the plugin’s logs, look forgenerateEcCert immediately followed by packageUserSize, and for clusters of roughly seven to ten concurrent calls per attempt: