Security Advisories
Critical vulnerabilities (CVEs) affecting cPanel, CloudLinux, LiteSpeed, Plesk and the Linux kernel — each with clear, step-by-step instructions to patch your server. Newest first.
- Critical advisory
LiteSpeed 6.3.7 Build 8 — Critical HTTP/3 (LSQUIC) Fix: How to Update
LiteSpeed 6.3.7 build 8 fixes a critical flaw in LSQUIC, its HTTP/3 engine. Check your build, update with one command, refresh the licence and verify.
- Advisory
cPanel & WHM Security Updates (August–October 2026): 7 CVEs + WP Toolkit — How to Patch
Seven cPanel & WHM flaws and two WP Toolkit flaws (Aug–Oct 2026) can let an account holder run commands or raise privileges. Check, update, verify.
- Advisory
ZDI-CAN-33367 — Linux Kernel Local Root Flaw: Check, Mitigate & Patch
A public exploit for kernel flaw ZDI-CAN-33367 lets any local user gain root. Check exposure, apply the one-line fix, then update the kernel or KernelCare.
- Critical advisory
DirectAdmin: How to Patch PHP CVE-2026-109618 & CVE-2026-109619 (Critical RCE)
Critical PHP RCE (CVE-2026-109618, CVE-2026-109619) on DirectAdmin: check your PHP versions, rebuild PHP with CustomBuild to a fixed release, and verify.
- Critical advisory
Plesk: How to Patch PHP CVE-2026-109618 & CVE-2026-109619 (Critical RCE)
Critical PHP RCE (CVE-2026-109618, CVE-2026-109619) on Plesk: check your PHP handlers, install the patched Plesk PHP builds with Plesk Installer, and verify.
- Critical advisory
CVE-2026-109618 & CVE-2026-109619 — Critical PHP RCE: How to Patch
Two critical PHP remote-code-execution flaws (CVE-2026-109618, CVE-2026-109619) were disclosed on 21 Oct 2026. cPanel EA-PHP and CloudLinux ALT-PHP patched packages are out…
- Advisory
Server Security Advisories — cPanel, CloudLinux, LiteSpeed & CSF
Current security advisories for cPanel, CloudLinux, LiteSpeed and CSF — CVE-2026-54420, GhostLock CVE-2026-43499, OVSwrap CVE-2026-64531 and the CSF root-access fix. How to check…