cPanel published an advisory on September 14 warning about a critical flaw in LiteSpeed Web Server Enterprise, and the mechanics of it are worth sitting with for a second. A low-privilege user on a shared hosting server, someone with nothing more than an ordinary hosting account, could exploit this flaw to reach root access on the entire machine. On a shared server, that means one compromised account potentially opens the door to every other customer’s site running alongside it.
The flaw affects every LiteSpeed Enterprise version before 6.3.7, which LiteSpeed released on September 11. According to cPanel, the vulnerability can bypass CageFS, the CloudLinux tool built specifically to keep hosting accounts isolated from each other and from the server’s own configuration files. That’s precisely the kind of protection a shared hosting environment depends on, and this flaw apparently walks right through it.
What’s notably missing from both companies’ disclosures is any real explanation of how the flaw actually works. LiteSpeed’s release notes for 6.3.7 mention “security improvements, bug fixes, and more,” and list three security changes in the changelog, but neither company has said which one addresses this specific issue. There’s no CVE identifier attached yet, no severity score, and no public statement on whether anyone has already exploited it in the wild.
Administrators need to update manually, since LiteSpeed warned there could be delays before 6.3.7 reaches automatic updates. Both companies point to the same fix: running /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7 from the command line. As of September 15, LiteSpeed’s own download page still listed the older, vulnerable 6.3.6 as the stable release, which says something about how quickly this patch is actually reaching servers on its own.
This marks the third time since May that a LiteSpeed-related flaw on cPanel servers has let a hosting account climb to root, though it’s the first time the flaw has lived inside the web server itself rather than a plugin. LiteSpeed’s cPanel plugin was hit twice earlier this year, and CISA added both of those to its Known Exploited Vulnerabilities catalog after confirming active exploitation. Whether this new flaw follows that same path remains unknown for now, but the pattern alone is reason enough for shared hosting administrators to patch immediately rather than wait.
