Skip to content
OriginalSign in

CISA

CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability

Part of the CVE-2026-54420 story · since 15 Jun

Quiet for 6 weekslast report 15 Sep8 articles4 outlets
15 Jun · CISA first31 Jul23 Aug15 Sep8 OctNowThis article2nd of 8
  • Mon 15 Jun, 19:40 UTC. CISA, first report. CISA Adds CVE-2026-54420 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:16 UTC. CISA. CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability. Cites a CVE in CISA KEV. This article, 2nd of 8.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline, its first report on the story. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Security Affairs. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts. Cites a CVE in CISA KEV.

The Known Exploited Vulnerabilities (KEV) Catalog is maintained by CISA to assist the cybersecurity community in managing vulnerabilities that have been actively exploited. It is an essential tool for organizations to prioritize their vulnerability management efforts. The catalog features detailed information about known vulnerabilities, including their associated risks and recommended mitigations.

One highlighted vulnerability is CVE-2026-54420, linked to the LiteSpeed cPanel Plugin, which involves a UNIX symbolic link vulnerability. Organizations are urged to follow vendor instructions and CISA guidelines for handling these vulnerabilities, including a specific focus on compliance with BOD 26-04 for risk prioritization. Additionally, the catalog is available in various formats and updates can be subscribed to via CISA's service.

How the story developed

All 8 articles
Quiet for 6 weekslast report 15 Sep8 articles4 outlets

8 articles from 4 outlets since 15 Jun. Quiet since 15 Sep. This was the 2nd report, within the hour.

Now15 Jun171814 Sep1617First reportCISA · 15 Jun, 19:40
  • Mon 15 Jun, 19:40 UTC. CISA, first report. CISA Adds CVE-2026-54420 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:16 UTC. CISA. CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability. Cites a CVE in CISA KEV. This article, 2nd of 8.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline, its first report on the story. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Security Affairs. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Mon 15 JunDay 02
    1. CISA Adds CVE-2026-54420 to Known Exploited Vulnerabilities Catalogue19:40 · CISA · official · First report · CISA alert · Known exploited CVE
    2. CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability20:16 · CISA · official · Known exploited CVE · This article, 2nd of 8
  2. Tue 16 JunDay 14
    1. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed01:30 · SecurityOnline · Known exploited CVE
    2. Inside the Stealthy Agent Tesla Infection Chain08:21 · SecurityOnline · Known exploited CVE
    3. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack09:29 · Security Affairs · Known exploited CVE
    4. Could Apple Build Its Own OpenClaw Competitor?09:30 · SecurityOnline · Known exploited CVE
  3. Wed 17 JunDay 21
    1. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root07:50 · SecurityWeek · Known exploited CVE

  4. Quiet for 13 weeks

    Tue 15 SepDay 921
    1. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts13:13 · Security Affairs · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in