42
Containers on fire: from container escapes to supply chain attacks
60
35
47
35
42
Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
Critical type-confusion flaw in isolated-vm Node.js sandbox (GHSA-864f-rcv7-6rh4) enables guest-to-host escape and potential RCE; fixed in 6.2.0 and 7.0.1.
Endor Labs researcher Cristian-Alexandru Staicu found a type confusion in the ExternalCopy component's handling of the transferList option in isolated-vm, letting sandboxed JavaScript corrupt host-process memory and escalate from controlled-address crashes to full control-flow hijack of the host, i.e., potential remote code execution. The flaw, tracked as GHSA-864f-rcv7-6rh4 with no CVE yet, affects all versions through 7.0.0 of the library, which sees nearly 1 million npm downloads weekly. It was patched in versions 6.2.0 and 7.0.1 released earlier in August 2026, and full exploit details are withheld to prevent attacks. The V8 Isolate boundary itself held; the failure was in the C++ marshalling code bridging host and guest.
58
30
35
30
42
42
35
60
30
30
30
35
55
42
60
30
30
57
cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access
Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.
cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.
65
LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server
cPanel warns critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets shared-hosting account users gain root access.
A cPanel advisory published September 14 warns that a critical vulnerability in LiteSpeed Web Server Enterprise versions before 6.3.7 lets a low-privilege website user gain root access on shared-hosting servers, bypassing CageFS account isolation. LiteSpeed released version 6.3.7 on September 11, but auto-update may be delayed so admins should force the update manually. No CVE identifier, severity score, workaround, or exploitation information has been published. This is the third LiteSpeed root flaw since May, following CVE-2026-48172 and CVE-2026-54420 in the cPanel plugin, which were both actively exploited and added to CISA's KEV catalog.
58
30
60
60
60
35
42
42
35
35
42
47
42
30
30