The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a three-day deadline for federal agencies to patch an actively exploited vulnerability in the LiteSpeed cPanel user-end plugin (CVE-2026-54420).
The Vulnerability
CVE-2026-54420 affects the LiteSpeed Cache plugin for cPanel, a widely-used web hosting control panel. The flaw allows attackers to execute unauthorized actions on vulnerable servers without proper authentication. CISA confirmed the vulnerability is being actively exploited in the wild.
Government Response
CISA issued the warning as part of its Binding Operational Directive (BOD) program, which compels federal agencies to take immediate security action. The three-day deadline reflects the severity of active exploitation. Agencies running affected cPanel instances must apply patches or implement mitigations immediately.
Why It Matters
LiteSpeed Cache is a popular performance optimization plugin used across many web hosting environments. A vulnerability in this widely-deployed tool creates significant risk for government infrastructure, particularly agencies hosting critical services. Active exploitation in the wild means attackers have already developed working attack methods.
Broader Context
This marks another significant cPanel-related security incident. cPanel hosting environments remain a frequent target for threat actors due to their prevalence in web hosting infrastructure. The plugin ecosystem creates additional attack surface beyond the core platform.
What Admins Should Do
Government agencies must immediately patch the affected plugin to the latest version. Organizations outside government should also prioritize this update. Administrators should verify patch deployment and monitor logs for signs of exploitation. Those unable to patch immediately should consider disabling the plugin until updates are available.
Details
Full technical details and remediation steps are available through CISA's advisories. The agency continues monitoring for new exploitation attempts and will update guidance as needed.
Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.
A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.
A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.
Security researchers scanning Polish government websites discovered critical vulnerabilities that could expose courts, hospitals, and airports to cyberattacks. The vulnerabilities stem from common software used to manage and display web content.