A Critical Flaw in LiteSpeed Lets One Shared Hosting Account Access Every Other Site

If your website sits on shared hosting and your provider uses LiteSpeed, there’s something worth knowing about right now. A critical vulnerability disclosed on September 14 means a malicious user with any account on the same server as yours could potentially read your files, alter your site, or install malware. Not because they hacked your account. Because they found a way around the controls meant to keep all the accounts separate.

Your host needs to patch this. Most have. Some haven’t checked. And a follow-up advisory dropped the very next day, meaning hosts that patched on September 14 may need to patch again.

Here is what the flaw actually does, which hosts are affected, and what you can realistically do about it.

What LiteSpeed Is and Why It Is Everywhere on Shared Hosting

LiteSpeed is a web server: the software that sits between your visitors and your website files and serves pages to their browsers. Think of it as an alternative to Apache or Nginx, built for speed. It handles requests faster, uses fewer server resources, and has its own built-in caching system. Hosts love it because it lets them squeeze more performance out of the same hardware.

As a result, it’s become very common on shared hosting. Providers that use LiteSpeed Enterprise for their shared plans include Hostinger, GreenGeeks, HostArmada, ScalaHosting, FastComet, and NameHero, among many others. If your host advertises LiteSpeed speed or LiteSpeed Cache as a feature, this applies to you.

What the Vulnerability Actually Does

Shared hosting puts many customers on one physical server. To stop one account from seeing another’s files, hosts use isolation tools. One of the most common is CageFS, a technology from CloudLinux that gives each hosting account its own restricted view of the server’s file system. You can only see your own files. Neighbouring accounts are invisible to you.

This vulnerability breaks that. A malicious user with a basic shared hosting account, the kind anyone can buy for a few dollars a month, can exploit the flaw to escape their restricted environment and potentially reach the root level of the server. Root is the highest access level on a Linux system. With root access, an attacker can read every website on the machine, modify files, install malware, or create persistent backdoors that survive a password reset.

The flaw affects LiteSpeed Web Server Enterprise in all versions before 6.3.7. The fix was released on September 11, and cPanel issued an urgent advisory on September 14 calling for immediate updates. No CVE identifier has been assigned yet, so there’s no official severity score. No confirmed exploitation in the wild has been reported as of September 17. That said, both of the similar LiteSpeed flaws from May and June were actively exploited before or shortly after disclosure, so waiting is not a sensible strategy.

There Was a Second Patch the Day After

Here is the part most coverage has missed. On September 16, just one day after the initial advisory, LiteSpeed released version 6.3.7 Build 1 with an additional security fix: another corner case in the internal redirect URL validation that the original patch had not fully addressed.

LiteSpeed’s own advisory said: “Even if you updated following yesterday’s advisory, please apply this latest update to ensure your server includes the additional validation improvement.”

So the remediation target is not just 6.3.7. It’s 6.3.7 Build 1 or later. If your host patched on September 14 or 15, they may need to patch again.

This Is the Third LiteSpeed Root-Access Flaw Since May

The September flaw doesn’t exist in isolation. It’s the third time since May 2026 that a vulnerability in LiteSpeed software on cPanel servers has been reported to grant a hosting account root access.

The first two were in the LiteSpeed cPanel plugin rather than the web server itself:

• May 2026: CVE-2026-48172, CVSS score of 10.0. Active exploitation confirmed. Added to CISA’s Known Exploited Vulnerabilities catalog.
• June 2026: CVE-2026-54420. Also actively exploited. Also added to CISA’s Known Exploited Vulnerabilities catalog.

The September flaw is in a different component: the web server itself. That makes it harder to work around than a plugin-level issue. Three root-access flaws in four months from the same software stack is a pattern worth paying attention to when choosing or evaluating a host.

What You Can and Cannot Do as a Site Owner

The honest answer is that you cannot patch this yourself. The fix sits at the server level and only your hosting provider can apply it. That’s the nature of shared hosting: you don’t control the underlying infrastructure.

What you can do:

• Ask your host directly. Contact support and ask: “Has LiteSpeed Enterprise been updated to version 6.3.7 Build 1 on my server?” A clear yes with a version confirmation is the answer you want. Vague reassurances about security being “a top priority” are not.
• Check for file changes. If you have cPanel access, review your public_html directory for any files you didn’t create. Anything unfamiliar is worth investigating.
• Rotate your cPanel password. It won’t protect against a server-level exploit, but it’s a sensible baseline step after any security disclosure affecting your environment.
• Check your host’s status page or blog. Larger hosts often publish security advisories or maintenance notices. If yours patched silently without communicating anything, that’s still fine. If they can’t confirm the version when asked, that’s worth noting.

Worth knowing: LiteSpeed warned that there may be a delay before 6.3.7 reaches the automatic update channel. A host running auto-updates may not yet have the patch. Manual installation is required to be certain. The update command for server admins is:

/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7

After that, a second update to the latest build is needed to pick up the Build 1 fix.

For a broader look at keeping your site secure at the application layer, the WordPress security checklist covers the steps that sit above the server and are within your direct control.

What About OpenLiteSpeed?

LiteSpeed comes in two editions. LiteSpeed Enterprise is the commercial version used by most managed hosting providers. OpenLiteSpeed is the free, open-source version used by some smaller hosts and available for self-hosted setups.

As of September 17, LiteSpeed has not confirmed whether OpenLiteSpeed is affected by this vulnerability. No matching patch has been released for OpenLiteSpeed. The hosting community has noted this publicly, with some administrators concerned that LiteSpeed may be withholding the root cause precisely because OpenLiteSpeed is open source and a patch would make the exploit mechanism visible.

If your host uses OpenLiteSpeed rather than the Enterprise edition, ask them directly what their position is and whether they’ve received any guidance from LiteSpeed.

Common Questions About the LiteSpeed Vulnerability

Which hosting providers use LiteSpeed?

LiteSpeed Enterprise is used by a large number of shared hosting providers, including Hostinger, GreenGeeks, HostArmada, ScalaHosting, FastComet, NameHero, A2 Hosting, and ChemiCloud, among many others. If your host advertises LiteSpeed or LiteSpeed Cache as a feature, they’re running one of the two editions.

How do I know if my host uses LiteSpeed Enterprise or OpenLiteSpeed?

Ask your host directly. You can also check the server HTTP response headers for your site using https://securityheaders.com/. The server header may identify the software version. Enterprise and OpenLiteSpeed can look similar from the outside, so a direct answer from support is the most reliable route.

Should I move to a VPS because of this?

Not necessarily, and not urgently. The flaw is patchable and the fix exists. A VPS gives you dedicated resources and your own isolated environment, but it comes with more management overhead and higher cost. The right question is whether your current host responds promptly and communicates clearly, not whether shared hosting is inherently unsafe.

Is LiteSpeed still a good web server after these flaws?

LiteSpeed remains a fast and widely deployed web server. The existence of vulnerabilities doesn’t make it uniquely unsafe. Apache and Nginx have had similar issues over their histories. What matters is how quickly the vendor patches and how responsive your host is. Three flaws in four months is a pattern to monitor, not a reason to abandon the platform outright.

What is CageFS and does this bypass it completely?

CageFS is a CloudLinux technology that isolates each shared hosting account inside its own restricted file system view, so accounts can’t see each other’s files or the server’s configuration. This vulnerability can bypass those controls, which is what makes it serious. Whether it was bypassed on any specific server depends entirely on whether that server has been patched to 6.3.7 Build 1.