CISA Urges Immediate Patching of Exploited LiteSpeed cPanel Plugin Zero-Day — One API Call Gives Root Access
A maximum-severity zero-day in the LiteSpeed cPanel plugin is being actively exploited. CISA has mandated federal agencies patch by May 29, 2026. A single malformed API call grants full root access to the server — no credentials, no race condition required. Millions of shared-hosting sites are exposed.
Read Full Analysis →Threats & Attacks
CVSS 10.0. Actively exploited. Federal deadline May 29. A single malformed API call grants root on the entire server. Enterprise exposure far wider than most IT teams know.
22,052 incidents. 12,195 confirmed breaches. Exploitation beats credentials for the first time. Ransomware in 44% of breaches. Supply chain attacks doubled. Only 26% of CISA KEV flaws patched.
Poisoned VS Code, npm, and GitHub packages. Active supply chain attack. Rotate credentials immediately if you had OpenVSX extensions installed Oct 2025–May 2026.
A crafted email triggers JavaScript inside an authenticated OWA session. No permanent patch. CISA KEV. Federal deadline May 29. Exchange Online is not affected.
Standard user in, SYSTEM shell out. Public PoC on GitHub. 6th zero-day in 6 weeks. First 3 confirmed used in real attacks. Patch not available until Patch Tuesday June 10.
No race condition. Public PoC. Container escape. Dirty Frag patch does NOT protect you. Third Linux root exploit in two weeks. Separate patch required immediately.
Intelligence & Deep Dive
Further Coverage
VulnCheck confirms real-world attacks. CVSS 9.2. ~34% of all internet web servers exposed. Patch to NGINX 1.30.1 immediately.
One SMTP sequence. Heap corrupted. Shell opened. Autonomous AI built the full exploit in 7 days. Patch to Exim 4.99.3 now.
732 bytes of Python. Root on every major distro since 2017. No race condition. No disk trace. Container escape primitive.
The same TeamPCP campaign that breached GitHub started here on April 30. Malicious PyPI packages, credential-stealing worm, IDE persistence hooks.
Hardcoded credentials and exposed API keys are a silent epidemic. Most teams only discover the problem after a breach.
A zero-day gives attackers a window defenders can’t close. How enterprises reduce damage before patches exist.
The DataWater Intelligence Brief
Weekly CISO-level threat analysis — breaking vulnerabilities, technical depth, zero noise. Trusted by enterprise and government security leaders.