CVE Tools
Track your stack

Joomla, LiteSpeed Vulnerabilities Exploited in Attacks

SecurityWeekBy Ionut Arghire

Reported exploitedJoomla Content Editor (JCE) ProLiteSpeed cPanel user-end plugin

Our summary

Attackers are exploiting security weaknesses in Joomla’s Content Editor (JCE) and the LiteSpeed cPanel plugin to gain code execution and escalate privileges. Joomla JCE Pro versions before 2.9.99.5 are affected by CVE-2026-48907, enabling unauthenticated abuse to upload arbitrary files and run PHP code; fixes were released in 2.9.99.5 and strengthened again in 2.9.99.6. Separately, LiteSpeed’s user-end cPanel plugin versions before 2.4.8 are impacted by CVE-2026-54420, where improper symlink handling can let attackers escalate to root on shared hosting running CloudLinux/CageFS; both issues have been added to CISA’s KEV catalog, underscoring the urgency to patch.

Read at SecurityWeek

SecurityWeek publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker News⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and MoreCVE-2026-48907, CVE-2026-54420
  2. Daily CyberSecurity (securityonline.info)2,060 New CVEs and 4 Actively Exploited Flaws (June 15-21, 2026)CVE-2026-48907, CVE-2026-54420
  3. The Hacker NewsLiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared ServerCVE-2026-54420
  4. The Hacker NewsCritical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole ServerCVE-2026-54420
  5. Rapid7 BlogMetasploit Wrap Up: Lot of summer shells and fit http profilesCVE-2026-48907
  6. The Hacker NewsiCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-DaysCVE-2026-48907
  7. BleepingComputerAustralia warns of global campaign targeting vulnerable CMS platformsCVE-2026-48907
  8. The Hacker NewsExposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress SitesCVE-2026-48907
  9. BleepingComputerCISA orders feds to patch max severity Joomla plugin flaw by FridayCVE-2026-48907
  10. The Hacker NewsCISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code ExecutionCVE-2026-48907

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store