CISA has given federal agencies three days to address CVE-2026-48172, an actively exploited privilege escalation flaw in the LiteSpeed cPanel plugin that lets unauthenticated attackers gain root execution. The agency is also pressing private-sector organizations to install vendor updates immediately.
The vulnerability stems from an incorrect privilege assignment weakness that enables remote attackers with no privileges to execute arbitrary scripts with root privileges.
CISA warned that this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
Administrators should immediately audit logs with the provided grep command and update any LiteSpeed cPanel user-end plugin versions between v2.3 and v2.4.4 to block active exploitation attempts.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
CISA added Ivanti Connect Secure flaws CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on October 30. Ivanti says attackers chained them with CVE-2026-104935. Fixes are in 25.1.1.3 and 22.8R2.6.
A critical heap-based buffer overflow affects the D-Link DIR-878 on firmware 1.20B05 through the HNAP Handler. The flaw allows remote unauthenticated attacks and has a public exploit available.
The Mobile Builder plugin for WordPress contains a privilege-escalation vulnerability in versions up to and including 1.4.2 that lets authenticated attackers grant themselves administrator rights. The flaw is tracked as CVE-2026-104799 and carries a CVSS 3.1 score of 8.8 from the CNA.
The WPO365 Microsoft 365 Graph Mailer WordPress plugin is vulnerable to stored cross-site scripting in versions through 6.2. Unauthenticated attackers can inject scripts via any mail-sending feature that accepts a submitter-controlled subject when OAuth setup is incomplete.
CVE-2026-120189 is a stack-based buffer overflow in the TFTP upload filename handler of D-Link DIR-505 firmware 1.10B02. It can be exploited remotely, a public exploit exists, and VulDB rates it CVSS 3.1 10.0.
