CISA Emergency: Exploited LiteSpeed cPanel Plugin Zero-Day Grants Root Access

A critical zero-day vulnerability in the LiteSpeed cPanel user-end plugin was exploited in the wild before a patch was released last week. Successful exploitation allowed attackers to execute scripts with root privileges on affected servers.

CISA has issued an emergency directive giving U.S. federal agencies four days to apply the patch. The combination of active exploitation, root-level code execution, and a mandatory federal patch window places this in the highest remediation priority tier.

cPanel administrators should apply the available LiteSpeed plugin patch immediately regardless of federal mandate status. Shared hosting environments running this plugin are particularly exposed given the root privilege impact.