{"id":10741,"date":"2026-09-16T19:00:29","date_gmt":"2026-09-16T23:00:29","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=10741"},"modified":"2026-09-16T19:00:29","modified_gmt":"2026-09-16T23:00:29","slug":"cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/","title":{"rendered":"cPanel&#8217;s third LiteSpeed root flaw in four months has no CVE yet"},"content":{"rendered":"<p dir=\"ltr\"><a href=\"https:\/\/www.cpanel.net\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">cPanel<\/a> published an advisory on September 14 warning about a critical flaw in <a href=\"https:\/\/www.litespeedtech.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">LiteSpeed Web Server Enterprise<\/a>, and the mechanics of it are worth sitting with for a second. A low-privilege user on a shared hosting server, someone with nothing more than an ordinary hosting account, could exploit this flaw to reach root access on the entire machine. On a shared server, that means one compromised account potentially opens the door to every other customer&#8217;s site running alongside it.<\/p>\n<p dir=\"ltr\">The flaw affects every LiteSpeed Enterprise version before 6.3.7, which LiteSpeed released on September 11. According to cPanel, the vulnerability can bypass CageFS, the <a href=\"https:\/\/hostingdiscussion.com\/news\/cloudlinux-sharpens-focus-on-wordpress-reliability-through-new-investment-in-seahawk\/\">CloudLinux<\/a> tool built specifically to keep hosting accounts isolated from each other and from the server&#8217;s own configuration files. That&#8217;s precisely the kind of protection a shared hosting environment depends on, and this flaw apparently walks right through it.<\/p>\n<p dir=\"ltr\">What&#8217;s notably missing from both companies&#8217; disclosures is any real explanation of how the flaw actually works. LiteSpeed&#8217;s release notes for 6.3.7 mention &#8220;security improvements, bug fixes, and more,&#8221; and list three security changes in the changelog, but neither company has said which one addresses this specific issue. There&#8217;s no CVE identifier attached yet, no severity score, and no public statement on whether anyone has already exploited it in the wild.<\/p>\n<p dir=\"ltr\">Administrators need to update manually, since <a href=\"https:\/\/hostingdiscussion.com\/news\/litespeed-partnership-pushes-hosted-com-toward-a-leaner-faster-internet-future\/\">LiteSpeed<\/a> warned there could be delays before 6.3.7 reaches automatic updates. Both companies point to the same fix: running \/usr\/local\/lsws\/admin\/misc\/lsup.sh -f -v 6.3.7 from the command line. As of September 15, LiteSpeed&#8217;s own download page still listed the older, vulnerable 6.3.6 as the stable release, which says something about how quickly this patch is actually reaching servers on its own.<\/p>\n<p dir=\"ltr\">This marks the third time since May that a LiteSpeed-related flaw on <a href=\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-root-access-flaw-in-six-weeks-has-no-clear-fix-explained\/\">cPanel<\/a> servers has let a hosting account climb to root, though it&#8217;s the first time the flaw has lived inside the web server itself rather than a plugin. LiteSpeed&#8217;s cPanel plugin was hit twice earlier this year, and CISA added both of those to its Known Exploited Vulnerabilities catalog after confirming active exploitation. Whether this new flaw follows that same path remains unknown for now, but the pattern alone is reason enough for shared hosting administrators to patch immediately rather than wait.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>cPanel published an advisory on September 14 warning about a critical flaw in LiteSpeed Web Server Enterprise, and the mechanics of it are worth sitting with for a second. A low-privilege user on a shared hosting server, someone with nothing more than an ordinary hosting account, could exploit this flaw to reach root access on [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[71],"tags":[8113,6830,8110,8112,8111],"class_list":["post-10741","post","type-post","status-publish","format-standard","hentry","category-featured","tag-cagefs-bypass","tag-cpanel-security","tag-litespeed-vulnerability","tag-root-privilege-escalation","tag-shared-hosting-exploit"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>cPanel&#039;s third LiteSpeed root flaw in four months has no CVE yet - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"cPanel&#039;s third LiteSpeed root flaw in four months has no CVE yet - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"cPanel published an advisory on September 14 warning about a critical flaw in LiteSpeed Web Server Enterprise, and the mechanics of it are worth sitting with for a second. A low-privilege user on a shared hosting server, someone with nothing more than an ordinary hosting account, could exploit this flaw to reach root access on [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-16T23:00:29+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/\",\"name\":\"cPanel's third LiteSpeed root flaw in four months has no CVE yet - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-09-16T23:00:29+00:00\",\"dateModified\":\"2026-09-16T23:00:29+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"cPanel&#8217;s third LiteSpeed root flaw in four months has no CVE yet\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"cPanel's third LiteSpeed root flaw in four months has no CVE yet - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/","og_locale":"en_US","og_type":"article","og_title":"cPanel's third LiteSpeed root flaw in four months has no CVE yet - Web Hosting News","og_description":"cPanel published an advisory on September 14 warning about a critical flaw in LiteSpeed Web Server Enterprise, and the mechanics of it are worth sitting with for a second. A low-privilege user on a shared hosting server, someone with nothing more than an ordinary hosting account, could exploit this flaw to reach root access on [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/","og_site_name":"Web Hosting News","article_published_time":"2026-09-16T23:00:29+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/","url":"https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/","name":"cPanel's third LiteSpeed root flaw in four months has no CVE yet - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-09-16T23:00:29+00:00","dateModified":"2026-09-16T23:00:29+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/cpanels-third-litespeed-root-flaw-in-four-months-has-no-cve-yet\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"cPanel&#8217;s third LiteSpeed root flaw in four months has no CVE yet"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":98,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10741","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=10741"}],"version-history":[{"count":2,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10741\/revisions"}],"predecessor-version":[{"id":10743,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10741\/revisions\/10743"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=10741"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=10741"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=10741"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}