LiteSpeed Enterprise flaw lets one hosting account gain root access

🚨 ACTIVE EXPLOITATION

• marimo-rce-aws-credential-theft — Cyber Security News

🕵️ RESEARCH & DEEP DIVES

• ESET uncovers CinderRelay, a previously undocumented Linux backdoor used by North Korea-aligned ScarCruft
  ESET Research has uncovered CinderRelay, a previously undocumented Linux server backdoor used by North Korea-aligned ScarCruft (APT37) to maintain long-term control of compromised infrastructure.
  • Applies to organizations targeted by ScarCruft (APT37), a North Korea-aligned espionage group, whose compromised Linux servers are backdoored.
  • CinderRelay is a previously undocumented Linux server backdoor that provides root shell access and credential theft to retain control of compromised infrastructure.
  • The backdoor implements a custom protocol whose counterpart was found in ScarCruft Windows malware, indicating a shared cross-platform codebase and a larger covert network.
  • Compromised systems connect through CinderRelay-backdoored servers; ESET linked live backdoored servers to past ScarCruft activity.
  • Findings by ESET researcher Filip Jurčacko will be presented at LABScon2026 on September 18 in Scottsdale, AZ.
  Sources 📎 Coverage: infosec.exchange · 👁 via @ESETresearch@infosec.exchange

📋 ADVISORIES

• LiteSpeed Enterprise flaw lets one hosting account gain root access on shared servers
  cPanel warned of a critical LiteSpeed Web Server Enterprise flaw that lets a low-privilege hosting account gain root access on shared-hosting servers.

  • Affects LiteSpeed Web Server Enterprise versions before 6.3.7, which was released September 11; OpenLiteSpeed has no matching fix as of September 15
  • An attacker with a single hosting account on a shared server can gain root and access or alter other sites and the server itself
  • The flaw can bypass account-isolation controls including CloudLinux's CageFS
  • The flaw carries no CVE identifier or severity score, and neither cPanel nor LiteSpeed has described how it works or said whether it is exploited
  • Fixed in 6.3.7 via /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7, since the release may be delayed in reaching auto-update
  Sources 📄 Source: support.cpanel.net · 📎 Coverage: thehackernews.com · 👁 via The Hacker News

• 📄 Source for Telegram Desktop XSS Flaw Let Attackers Steal Chat Messages via Poisoned HTML Exports — expatch.com

🔓 CVEs & KEV

• CVE-2026-90711 — proxy-addr — CVSS 9.1 — proxy-addr IP Spoofing Bypass (CVE-2026-90711)

• CVE-2026-91778 — Octopus Deploy Octopus Server — CVSS 7.2 — In affected versions of Octopus Server, users with certain scoped permission ...