Litespeed

CVE-2026-54420 exploits symlink mishandling to escalate privileges on shared hosting servers. CISA mandates federal patching within 48 hours as attackers target multi-tenant environments.

Critical CVE-2026-48172 in LiteSpeed cPanel plugin enables root privilege escalation. CVSS 10.0, actively exploited, CISA KEV deadline May 29. Patch immediately.