ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “LiteSpeed”

42 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 23Ransomware 7Exploit / PoC 6Malware 3Threat actor 3Data breach 1
SeverityAllcritical 28high 9medium 6low 0info 0

LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server

cPanel warns critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets shared-hosting account users gain root access.

A cPanel advisory published September 14 warns that a critical vulnerability in LiteSpeed Web Server Enterprise versions before 6.3.7 lets a low-privilege website user gain root access on shared-hosting servers, bypassing CageFS account isolation. LiteSpeed released version 6.3.7 on September 11, but auto-update may be delayed so admins should force the update manually. No CVE identifier, severity score, workaround, or exploitation information has been published. This is the third LiteSpeed root flaw since May, following CVE-2026-48172 and CVE-2026-54420 in the cPanel plugin, which were both actively exploited and added to CISA's KEV catalog.

The Hacker Newsupdated · 1d agofirst · 1d agoVulnerability 2 sourcesCVE-2026-48172CVE-2026-54420

cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access

Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.

cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.

Cyber Security News · 1d agoVulnerability

Multiple ArtraDownloader Variants Used by BITTER to Target Pakistan

BITTER used three ArtraDownloader variants since 2015 to target Pakistan, China, and Saudi Arabia, deploying BitterRAT and exploiting CVE-2017-11882 in one wave.

Palo Alto Unit 42 documents ArtraDownloader, a previously unreported downloader family used by the suspected South Asian group BITTER, with three variants and roughly 80 unique samples dating back to February 2015. Between September 2018 and January 2019, BITTER used spearphishing documents hosted on compromised Pakistani websites to target Pakistan and, for the first time, Saudi Arabia; one RTF sample exploited the EQNEDT vulnerability CVE-2017-11882. The downloader retrieves BitterRAT over HTTP, uses simple registry keys for persistence, and byte-level string obfuscation. Infrastructure overlap with the previously reported MY24 InPage-exploit payload was also observed.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wildCVE-2017-11882

Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator

Suspected Chinese-speaking operator breached Philippine nuclear research and naval supplier systems via ownCloud CVE-2023-49103 and WordPress CVE-2024-28000.

Hunt.io found an exposed staging server containing custom Python scripts, logs, and stolen data documenting intrusions against a Philippine nuclear research body and a marine engineering company serving the Philippine Navy. The actor exploited an ownCloud authentication bypass (CVE-2023-49103) using empty-secret pre-signed WebDAV URLs and a LiteSpeed Cache plugin flaw (CVE-2024-28000) to gain WordPress admin access, also guessing passwords against XML-RPC with rockyou.txt. Roughly 9 GB was referenced as stolen from the nuclear agency, including reactor databases, radiation-safety records, and staff passport data; Simplified Chinese labels suggest a Chinese-speaking operator.

Security Affairs · 18d agoThreat actor in the wildCVE-2023-49103CVE-2024-28000

ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body

A Chinese-speaking actor exploited ownCloud CVE-2023-49105 to steal 176 nuclear research files from Philippine organizations, prompting CISA to add the flaw to KEV.

CISA added CVE-2023-49105 (CVSS 9.8), an ownCloud WebDAV API authentication bypass fixed in version 10.13.1, to the KEV catalog after Hunt.io found an open directory hosting custom Python exploit scripts and tools including Sliver, Metasploit, and Mettle. The actor downloaded 176 files (~372 MB) from a Philippine nuclear research body, including nuclear-material account records, 2023-2028 strategic plans, BitLocker keys, and a KeePass database; a second intrusion exploited LiteSpeed Cache CVE-2024-28000 at a shipbuilding firm serving the Philippine Navy, with XML-RPC brute-force and an EtherHiding/ClickFix component. FCEB agencies must patch by August 30, 2026. CISA also added Linux Kernel CVE-2026-53362 and Artifactory CVE-2026-66384 after OpenAI said its AI agents exploited them against internal infrastructure.

The Hacker News · 19d agoExploit / PoC in the wildCVE-2023-49105CVE-2024-28000CVE-2026-53362+1 CVEs1

Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

cPanel patched critical flaw CVE-2026-65643 letting authenticated hosting customers with addon or parked domain rights execute code as root and fully compromise servers.

cPanel issued patches on August 27, 2026 for CVE-2026-65643, a flaw in domain parking and addon domain functionality in cPanel & WHM that lets an authenticated account holder create arbitrary files and execute code as root, yielding full server control. Fixed builds cover the 11.110, 11.134, 11.136 and 11.138 branches, including WP Squared 11.138.1.7, and auto-update servers receive the fix automatically. No CVSS score, published CVE record, or evidence of exploitation has appeared, and the flaw is absent from CISA's KEV catalog as of August 27. The article also recaps related 2026 cPanel-ecosystem issues, including KEV-listed LiteSpeed plugin flaws and the in-the-wild-exploited Phusion Passenger problem.

The Hacker News · 19d agoVulnerabilityCVE-2026-65643CVE-2026-58048CVE-2026-58047+3 CVEs