Security: LiteSpeed plugin automatically removed during nightly update – May 19, 2026

A security vulnerability was found in the plugin provided by LiteSpeed that allowed unauthorized root access to the server.

High 2026-09-08

cPanel LiteSpeed

SharedLicense लाइसेंस के तहत इसका अर्थ

Your SharedLicense license itself is not affected — this is a change in cPanel & WHM software, not in licensing. This is a maintenance change, not a vulnerability — no action beyond your normal update cycle. Licenses keep working through updates; nothing needs re-issuing or re-activating.

Situation

A security vulnerability was found in the plugin provided by LiteSpeed that allowed unauthorized root access to the server.

Impact

In order to mitigate this vulnerability further, it is recommended to disable the LiteSpeed User-End Plugin for cPanel. This plugin will be automatically removed as part of the cPanel update on May 19, 2026, for all cPanel versions.

Note: The LiteSpeed web service will continue to function without issue.

Call to Action

The LiteSpeed plugin will be automatically disabled as part of the cPanel update process. Run the following to ensure that cPanel is fully up-to-date:

# /scripts/upcp –force

To immediately process the plugin removal, the following command should be run:

# /usr/local/lsws/admin/misc/lscmctl cpanelplugin –uninstall