Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
11 / 11 results
criticalbug_reportVulnerabilitycPanel CalDAV flaw allows hosting account holders to execute code as root
cPanel & WHM version 120 and later (CVE-2026-87899, CVE-2026-68490); WP Toolkit 6.11.2-10794 and older (CVE-2026-87900). Affects shared hosting environments where cPanel is deployed. WP Squared also affected.
highbug_reportVulnerabilityAcronis cPanel/Plesk backup plugin flaw exploited for Linux privilege escalation
Acronis Backup plugin for cPanel & WHM (builds < 1.9.3.1021) and Acronis Backup extension for Plesk (builds < 1.8.11.638). Affects Linux servers running these backup integrations in web hosting environments.
criticalbug_reportVulnerabilityLiteSpeed Enterprise pre-6.3.7 privilege escalation grants root on shared hosts
LiteSpeed Web Server Enterprise versions before 6.3.7 on shared hosting environments. The vulnerability bypasses isolation controls including CageFS. OpenLiteSpeed status unknown; no matching update released as of September 15.
criticalbug_reportVulnerabilityCritical RCE flaws in cPanel WHM and ConfigServer CSF enable root access
cPanel WHM (Web Host Manager) and ConfigServer Security & Firewall (CSF). Specific vulnerable versions not disclosed in available data. Affects hosting providers and servers using these control panel and firewall management tools.
criticalbug_reportVulnerabilitycPanel SQL injection flaw allows mail users to escalate to root
All supported versions of cPanel and WHM (release lines 11.110, 11.134, 11.136, 11.138, and WP Squared). Fixed in builds 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and 11.138.1.9 (WP Squared).
highbug_reportVulnerabilitycPanel SQL privilege escalation lets hosting customers run commands as root
cPanel & WHM all supported versions prior to 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and WP Squared prior to 138.1.6. Requires authenticated cPanel account with MySQL/MariaDB feature access.
highperson_alertThreat ActorGitHub Actions Abused to Scan and Exploit cPanel/WHM Servers
The threat actor behind this campaign remains unattributed. The operation demonstrates sophisticated understanding of GitHub Actions infrastructure and supply chain attack vectors.
criticalbug_reportVulnerabilityCISA orders patch for exploited LiteSpeed cPanel plugin flaw (3-day deadline)
LiteSpeed cPanel user-end plugin (specific versions not disclosed). Affects web hosting environments using cPanel with LiteSpeed integration. U.S. federal agencies explicitly targeted by CISA directive.
highbug_reportVulnerabilityCISA adds LiteSpeed cPanel Plugin privilege escalation to KEV catalog
LiteSpeed cPanel Plugin (specific versions not disclosed). Affects web hosting environments using cPanel with LiteSpeed integration. Federal agencies and hosting providers running this plugin are in scope.
criticalbug_reportVulnerabilityCISA orders federal agencies to patch LiteSpeed cPanel plugin in 4 days
LiteSpeed cPanel user-end plugin. Specific vulnerable versions not disclosed. Affects organizations using cPanel with LiteSpeed integration.
criticalbug_reportVulnerabilityLiteSpeed cPanel/WHM plugin under active exploit (CVE-2026-48172)
LiteSpeed plugin for cPanel/WHM. Specific vulnerable versions not disclosed in provided data. Affects web hosting environments using LiteSpeed with cPanel/WHM integration.