LiteSpeed cPanel Plugin CVE-2026-48172 Exploited for Root Access
CISA added LiteSpeed cPanel Plugin CVE-2026-48172 to KEV after active exploitation. Update to the fixed WHM/cPanel plugin bundle and check logs for redisAble abuse.
Author profile
Emma Davis
Content editor and security writer focused on making malware-removal and scam-prevention guides easier to understand. Emma reviews structure, clarity, and source consistency before articles are published.
1,078 articles
Editorial review
Reader clarity
Security guidance
Published work
Recent articles by Emma Davis
News · May 26, 2026
KnowledgeDeliver CVE-2026-5426: Zero-Day RCE Used to Drop Godzilla Web Shell
KnowledgeDeliver CVE-2026-5426 was exploited as a zero-day through shared ASP.NET machine keys. Rotate keys, restrict exposure, and hunt IIS logs for ViewState abuse.
News · May 24, 2026
Ghost CMS CVE-2026-26980 Exploited to Inject ClickFix Malware
Ghost CMS CVE-2026-26980 is being exploited to steal Admin API keys, inject malicious JavaScript into posts, and send visitors to ClickFix/FakeCaptcha malware pages.
News · May 23, 2026
Laravel-Lang Composer Packages Hijacked to Drop Credential Stealer
Laravel-Lang Composer packages were hijacked through rewritten GitHub tags to load a credential stealer. Check composer.lock, src/helpers.php, autoload.files, and rotate exposed CI secrets.
News · May 22, 2026
Drupal Core CVE-2026-9082 SQL Injection Is Being Exploited
Drupal Core CVE-2026-9082 is a PostgreSQL-only SQL injection flaw now listed in CISA KEV. Patch affected Drupal branches and check logs for exploit attempts.
News · May 21, 2026
Microsoft Defender CVE-2026-41091 and CVE-2026-45498 Exploited in Attacks
Microsoft Defender CVE-2026-41091 and CVE-2026-45498 are exploited in attacks. Check Engine 1.1.26040.8, Platform 4.18.26040.7, and update endpoints before the CISA KEV deadline.
News · May 20, 2026
SonicWall Gen6 CVE-2024-12802 MFA Bypass Still Enables VPN Attacks
Attackers are bypassing MFA on SonicWall Gen6 SSL-VPN devices where CVE-2024-12802 remediation was incomplete. Disable LDAP UPN login, check VPN logs, and replace unsupported...
News · May 19, 2026
ChromaDB CVE-2026-45829: Pre-Auth RCE Risk in Python Server
ChromaDB CVE-2026-45829, dubbed ChromaToast, can let an unauthenticated attacker execute code through malicious embedding model loading before authentication checks run.
News · May 18, 2026
SHub Reaper macOS Infostealer Spoofs Apple Security Updates
SHub Reaper is a macOS infostealer campaign that abuses AppleScript, fake security updates, and GoogleUpdate-like LaunchAgents to steal browser data, wallets, files, and sessions.
News · May 17, 2026
NGINX CVE-2026-42945 Rewrite Module Flaw Is Being Exploited
NGINX CVE-2026-42945 is now being exploited in the wild, according to VulnCheck activity reported by The Hacker News. Patch exposed NGINX servers and review...
News · May 16, 2026
Funnel Builder WooCommerce Flaw Exploited to Steal Card Data
Attackers are exploiting Funnel Builder by FunnelKit before version 3.15.0.3 to inject fake analytics scripts into WooCommerce checkout pages and steal payment details.
News · May 15, 2026
Microsoft Exchange CVE-2026-42897 OWA XSS Is Being Exploited
Microsoft says CVE-2026-42897 is being exploited against on-premises Exchange Server. Admins should verify EEMS or EOMT mitigation, check OWA exposure, and review suspicious webmail...
