The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a three-day deadline for federal agencies to patch an actively exploited vulnerability in the LiteSpeed cPanel user-end plugin (CVE-2026-54420).
The Vulnerability
CVE-2026-54420 affects the LiteSpeed Cache plugin for cPanel, a widely-used web hosting control panel. The flaw allows attackers to execute unauthorized actions on vulnerable servers without proper authentication. CISA confirmed the vulnerability is being actively exploited in the wild.
Government Response
CISA issued the warning as part of its Binding Operational Directive (BOD) program, which compels federal agencies to take immediate security action. The three-day deadline reflects the severity of active exploitation. Agencies running affected cPanel instances must apply patches or implement mitigations immediately.
Why It Matters
LiteSpeed Cache is a popular performance optimization plugin used across many web hosting environments. A vulnerability in this widely-deployed tool creates significant risk for government infrastructure, particularly agencies hosting critical services. Active exploitation in the wild means attackers have already developed working attack methods.
Broader Context
This marks another significant cPanel-related security incident. cPanel hosting environments remain a frequent target for threat actors due to their prevalence in web hosting infrastructure. The plugin ecosystem creates additional attack surface beyond the core platform.
What Admins Should Do
Government agencies must immediately patch the affected plugin to the latest version. Organizations outside government should also prioritize this update. Administrators should verify patch deployment and monitor logs for signs of exploitation. Those unable to patch immediately should consider disabling the plugin until updates are available.
Details
Full technical details and remediation steps are available through CISA's advisories. The agency continues monitoring for new exploitation attempts and will update guidance as needed.
Pharmaceutical giant Amgen confirmed a data breach affecting multiple cloud systems operated by third-party providers. Threat actors accessed both patient health information and proprietary corporate data.
Arch Linux has temporarily disabled the adoption feature for Arch User Repository (AUR) packages following a spike in malicious takeovers. The move aims to prevent attackers from seizing control of unmaintained packages.
Tailscale's security network failed to prevent an intrusion at Hugging Face, according to a new blog post from the company. The incident highlights limitations in network-based security approaches.
Advertising platform Adform fell victim to a supply-chain attack that injected malicious code into its ad scripts, redirecting cryptocurrency wallet addresses from users' clipboards to attacker-controlled accounts.