The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a three-day deadline for federal agencies to patch an actively exploited vulnerability in the LiteSpeed cPanel user-end plugin (CVE-2026-54420).
The Vulnerability
CVE-2026-54420 affects the LiteSpeed Cache plugin for cPanel, a widely-used web hosting control panel. The flaw allows attackers to execute unauthorized actions on vulnerable servers without proper authentication. CISA confirmed the vulnerability is being actively exploited in the wild.
Government Response
CISA issued the warning as part of its Binding Operational Directive (BOD) program, which compels federal agencies to take immediate security action. The three-day deadline reflects the severity of active exploitation. Agencies running affected cPanel instances must apply patches or implement mitigations immediately.
Why It Matters
LiteSpeed Cache is a popular performance optimization plugin used across many web hosting environments. A vulnerability in this widely-deployed tool creates significant risk for government infrastructure, particularly agencies hosting critical services. Active exploitation in the wild means attackers have already developed working attack methods.
Broader Context
This marks another significant cPanel-related security incident. cPanel hosting environments remain a frequent target for threat actors due to their prevalence in web hosting infrastructure. The plugin ecosystem creates additional attack surface beyond the core platform.
What Admins Should Do
Government agencies must immediately patch the affected plugin to the latest version. Organizations outside government should also prioritize this update. Administrators should verify patch deployment and monitor logs for signs of exploitation. Those unable to patch immediately should consider disabling the plugin until updates are available.
Details
Full technical details and remediation steps are available through CISA's advisories. The agency continues monitoring for new exploitation attempts and will update guidance as needed.
An IT mistake at English hospitals resulted in the loss of 11 years of viewing history for maternity patient records. Hospital staff recovered the underlying patient care data, though access logs remain unrecoverable.
A new Windows malware called ClosedQuorum leverages multiple AI models to autonomously decide its attack strategy after gaining system access. The threat uses Google Gemini, DeepSeek, Qwen, and Mistral to determine post-compromise actions.
Researchers have identified stolen credentials as a critical vulnerability threatening America's water infrastructure. The exposed passwords create direct pathways for attackers to access essential systems.
Microsoft's Digital Crimes Unit has shut down EvilTokens, a phishing-as-a-service platform that compromised over 12,000 Microsoft accounts across 10,000+ organizations.