cPanel has flagged a critical vulnerability in LiteSpeed Web Server Enterprise that could allow a low-privilege website user to obtain root access on a shared-hosting server. The advisory, published September 14, warns that the flaw is serious because many customer sites are hosted on the same physical machine.
On a shared server, a successful exploit would let an attacker move from a single hosting account to full control of the underlying operating system. That would put all other accounts on the server at risk, including their data and configurations.
The source for this article is a single advisory report from cPanel; it does not provide details about a patch version or whether the vulnerability has been exploited in the wild. Administrators running LiteSpeed Enterprise in shared-hosting environments should treat the advisory as urgent and review their exposure.