Resolved incident
LiteSpeed security advisory
Liquid Web · Minor · Started
- Duration
- 17h 18m
- Severity
- Minor
- Status
- Resolved
Summary
Minor · Resolved
All accessible Fully Managed and Core Managed servers running outdated versions of LiteSpeed have been successfully updated to the patched version, 6.3.7. Services have remained operational, and no additional issues have been identified during monitoring. This incident is now resolved. If you have any questions or concerns, please contact support@liquidweb.com.
Event timeline
How this incident unfolded, from the official status page.
Investigating
Liquid Web
WebPros (cPanel) posted news regarding a critical privilege-escalation vulnerability within the LiteSpeed software. A malicious website user could potentially gain root-level access to the server (even bypassing account isolation controls such as CageFS). More Information can be found here: https://support.cpanel.net/hc/en-us/articles/43483286674583-Security-LiteSpeed-Enterprise-security-advisory-September-14-2026 We will attempt to update LiteSpeed to the patched version (6.3.7) where we are able to via Automation. Regardless, please ensure your Litespeed is up-to-date. If you have any questions or concerns, please contact support@liquidweb.com
Monitoring
Liquid Web
All accessible Fully and Core-Managed servers running outdated versions of LiteSpeed have been patched to version 6.3.7. The same webserver service that was in use before the LiteSpeed upgrade remains in use afterwards. If you have any questions or concerns, please contact support@liquidweb.com.
Resolved
Liquid Web
All accessible Fully Managed and Core Managed servers running outdated versions of LiteSpeed have been successfully updated to the patched version, 6.3.7. Services have remained operational, and no additional issues have been identified during monitoring. This incident is now resolved. If you have any questions or concerns, please contact support@liquidweb.com.