CVE-2026-48907 and LiteSpeed cPanel Plugin Flaws Come Under Active Attack

Security researchers warn that CVE-2026-48907 in the Joomla Content Editor (JCE) is being actively exploited in the wild to upload malicious editor profiles that allow unauthenticated arbitrary PHP upload and remote code execution; administrators are urged to update to JCE 2.9.99.6 (or apply provided patches for legacy branches), check for rogue profiles and unexpected PHP files, preserve forensic artifacts, and rebuild compromised systems. Separately, a LiteSpeed cPanel plugin vulnerability enables privilege escalation to root on shared hosting, increasing the risk to hosting environments.