On June 2, 2026, LiteSpeed Technologies issued an urgent security advisory for the LiteSpeed User-End cPanel Plugin. A second privilege-escalation vulnerability, separate from the one disclosed on May 19, has been identified and is being actively exploited in the wild. A CVE identifier is forthcoming but had not been assigned at the time of disclosure. The fix is LiteSpeed WHM Plugin v5.3.2.1, which bundles the patched cPanel plugin v2.4.8. The parent LiteSpeed WHM Plugin is not affected.
This is the second time in two weeks that the LiteSpeed User-End cPanel Plugin has shipped with an actively-exploited privilege escalation vulnerability. cPanel has, for the second time, pushed a one-time uninstall command across cPanel servers where the plugin is detected. That is an extraordinary step that cPanel almost never takes with third-party software, and the fact that it has now been taken twice in 15 days signals how seriously both vendors are treating this class of issue.
If you are a Gotekky managed cPanel customer, your server is already protected. The LiteSpeed User-End cPanel Plugin was uninstalled on managed servers during the May 19 emergency patch and has not been redeployed since. The conservative stance we took on May 19 (wait several weeks past a security review before considering redeployment) has now paid off: managed customers were never exposed to this second vulnerability. The rest of this guide explains what is known, how to check whether your own servers were exploited if you operate self-managed cPanel infrastructure, and what to do now.
What is known so far
Specific facts from the LiteSpeed advisory:
- Affected: LiteSpeed User-End cPanel Plugin prior to version 2.4.8
- Not affected: LiteSpeed WHM Plugin (the parent plugin)
- Fix: upgrade to LiteSpeed WHM Plugin v5.3.2.1, which bundles cPanel plugin v2.4.8
- Active exploitation: confirmed in the wild before disclosure
- CVE: forthcoming, not yet assigned at disclosure time
- Vendor mitigation: cPanel has pushed a one-time uninstall command across cPanel servers where the plugin is detected, the same mechanism used on May 19
The advisory's indicators of compromise point to specific API calls in cPanel access logs. The exploitation pattern abuses the generateEcCert function (which generates EC SSL certificates) and the packageUserSize function (which calculates user account size), along with certificate action log entries that contain the string "geneccert". Without the full technical disclosure (the CVE has not landed and the exploit chain has not been fully documented), the most useful information is the IoC check itself.
How to check if your server has been exploited
LiteSpeed published a single grep command that searches both cPanel log directories for the specific API calls used by the exploit. As root on any cPanel server that ran the LiteSpeed User-End plugin in the past few weeks:
grep -rE 'cpanel_jsonapi_func=(generateEcCert|packageUserSize)|cert_action_entry .*geneccert' /usr/local/cpanel/logs/ /var/cpanel/logs/ 2>/dev/null
Interpretation:
- No output: your server is clean. The exploit was not run against it during the log retention window.
- Any output: your server may have been exploited. Treat this as a compromise indicator. Capture the full output (do not discard the matched log lines), preserve the log files, and proceed with a full incident response. Contact your hosting provider or security team immediately.
Log retention varies by cPanel configuration. Most cPanel installations retain access logs for 30 days. If your server was patched and uninstalled on May 19 but logs older than May 19 are still available, the IoC check will still surface exploitation attempts from before that date. If you are on a longer retention window, run the check across all available history.
The grep pattern is intentionally narrow: it matches only the specific API function calls used by the public exploit. This means false positives are rare. A match is a real signal worth investigating.
What Gotekky did and what managed customers need to know
The LiteSpeed User-End cPanel Plugin was uninstalled on every Gotekky managed server during the May 19 emergency patch deployment. On June 2, after this second vulnerability was disclosed, we ran the IoC check across the managed fleet and verified the plugin remains uninstalled where it was previously removed. No indicators of compromise were found on managed infrastructure for this vulnerability.
The May 19 conservative posture (uninstall the plugin, wait for security review before considering redeployment) has now been validated twice. We continue to hold the same position: the LiteSpeed User-End cPanel Plugin will not be redeployed on Gotekky managed infrastructure until LiteSpeed Technologies has shipped multiple stable releases without further critical vulnerabilities, and an independent security review has confirmed the plugin's code is stable. There is no firm timeline for that decision. Until then, customer requests for LiteSpeed Cache management on managed accounts continue to be served through alternative paths (server-level cache purge by support, the LiteSpeed Cache WordPress plugin for WordPress sites, and direct command-line cache management for technical customers).
For customers on Gotekky managed plans, no action is required. If you previously used the LiteSpeed cPanel icon and have been managing without it since May 19, that arrangement continues unchanged.
If you operate self-managed cPanel servers, do this now
The recommended action is to apply the upstream fix immediately. cPanel's automated uninstall is a stopgap that you should not rely on as a permanent solution, because the plugin can be reinstalled inadvertently through cPanel feature deployments, WHM addon management, or LiteSpeed's own automated installation tools.
Option A: Upgrade to the patched plugin
This is the right path if your customers actively use LiteSpeed Cache management through cPanel. As root:
# Upgrade the LiteSpeed WHM Plugin (which bundles the patched User-End plugin) /usr/local/lsws/admin/misc/lscmctl plugin --upgrade # Verify the version /usr/local/lsws/admin/misc/lscmctl plugin --version # Expected: LiteSpeed WHM Plugin v5.3.2.1 or later # (with User-End plugin v2.4.8 or later)
If the version returned is older than 5.3.2.1 / 2.4.8, the upgrade did not succeed. Investigate the upgrade output for errors and engage LiteSpeed support if needed.
Option B: Uninstall the plugin entirely
This is the right path if you do not have customers actively using the cPanel-side LiteSpeed management interface, or if you want defense in depth even after upgrading. As root:
/usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstall
This removes the User-End plugin from existing cPanel accounts and prevents it from being installed on new accounts. The parent LiteSpeed WHM Plugin (for administrators) is unaffected and continues to function. LiteSpeed Cache itself continues to function at the server level. Only the per-account cPanel-side management interface is removed.
Option C: Both (recommended)
For the most conservative posture: uninstall the plugin first, then upgrade the parent LiteSpeed WHM Plugin to 5.3.2.1 (which provides the latest server-side fixes), and leave the cPanel-side User-End plugin uninstalled. This is the configuration Gotekky operates on managed servers.
If the IoC check returned matches
Treat the server as compromised and follow a full incident response procedure:
- Take an immediate disk image or filesystem snapshot for forensic review. Do this before any further changes to the server.
- Rotate every credential on the server: root password, every WHM user password, every cPanel user password, every database password, every email account password, all API tokens, and any SSH keys that may have been on the server.
- Audit /root/.ssh/authorized_keys and every cPanel home directory's authorized_keys file for unfamiliar entries.
- Audit cron jobs in /etc/cron.d/, /etc/crontab, and every cPanel user's crontab for unfamiliar entries.
- Audit WHM for unfamiliar reseller or root accounts created during the exposure window.
- Search hosted websites for backdoors, particularly unfamiliar .php files in document roots with recent modification times.
- Review SSL/TLS certificates issued from the server during the exposure window. The exploit's use of generateEcCert suggests certificate issuance may be part of the attack chain.
- Consider that any WHMCS billing platform running on the same server may also be compromised.
If you operate hosted customer data on this server, Canadian regulatory frameworks may require breach notification. Under PIPEDA, breaches of security safeguards involving real risk of significant harm to individuals trigger mandatory reporting to the Office of the Privacy Commissioner of Canada and notification to affected individuals. Under Quebec's Law 25, the threshold is similar with an additional reporting obligation to the Commission d'accès à l'information. Document your timeline carefully if the compromise check returned matches.
The pattern: two LiteSpeed plugin RCEs in fifteen days
The LiteSpeed User-End cPanel Plugin has now shipped two actively-exploited privilege escalation vulnerabilities in 15 days. cPanel has, for the second time, pushed an automated uninstall command across servers where the plugin is detected. This is an extraordinary step. cPanel does not casually remove third-party software from customer servers. Two such removals in two weeks signals that both vendors view this plugin's security posture as fundamentally unreliable in its current state.
For hosting operators, the takeaway is direct. The cost-benefit calculation on running this specific plugin has shifted. Two actively-exploited RCEs in 15 days, with the second following so closely on the first that the patched May 19 plugin was itself vulnerable, is the kind of pattern that prompts security-conscious operators to remove the plugin from their stack until a sustained period of stable releases re-establishes confidence. The functionality the plugin provides (cPanel-side LiteSpeed Cache management) is convenient but not essential, and alternative paths exist for every customer use case. Removing the plugin from the stack is a defensible operational decision.
This is also the broader context: the spring 2026 hosting infrastructure stack has now produced four cPanel emergency patches, four Linux kernel privilege escalation vulnerabilities, one WHMCS authorization bypass, and two LiteSpeed plugin RCEs in approximately five weeks. Operators cannot rely on monthly maintenance windows. Continuous patch deployment, automated build-version verification, and standard compromise auditing as part of every post-patch workflow are now baseline expectations for any Canadian hosting business operating under PIPEDA, Law 25, or SOC 2 frameworks. Gotekky publishes dedicated guides for each significant issue and maintains them as new information arrives.