CISA Issues Urgent Warning on Actively Exploited LiteSpeed cPanel Plugin Vulnerability

The U.S. CISA warned of CVE-2026-54420, a critical privilege-escalation flaw in the LiteSpeed cPanel plugin allowing attackers with FTP or web-shell access to obtain root on shared hosting (CloudLinux/CageFS). The vulnerability is being actively exploited, was added to CISA's Known Exploited Vulnerabilities Catalog, and federal agencies were ordered to remediate within three days; vendor patches (2.4.8+) and forensic checks are recommended.