Vulnerabilities & Exploits · Web App Attack

Exploited Joomla and LiteSpeed bugs leave backdoors behind

Patching is only the first step here. On Joomla, attackers are using an access-control flaw to create trusted editor profiles and plant persistent web shells. On LiteSpeed shared hosting, a symlink bug lets someone who already has FTP or web-shell access cross into root, so one account foothold can become a host-level compromise.

JCE versions before 2.9.99.5 are affected, with extra protections in 2.9.99.6. LiteSpeed’s cPanel plugin is vulnerable in all versions before 2.4.8, and the WHM PlugIn fix is 5.3.2.0. Both flaws are being actively exploited, both are now in CISA’s KEV catalog, and Joomla says public exploit code is already being used in automated attacks.

The bigger risk is post-compromise persistence. A patched Joomla site can still carry a rogue profile or web shell, and a patched shared host can still be owned if the attacker already used the symlink path to reach root.

21 sources · Jun 24

CVE-2026-48907

NVD KEV

Known exploited · CISA KEV

EPSS 85% (100th percentile).

CISA federal remediation date Jun 19 · date passed

CVE-2026-54420

NVD KEV

Known exploited · CISA KEV

CVSS 8.5 HIGH: liteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks… EPSS 1% (73rd percentile).

CISA federal remediation date Jun 18 · date passed

Timeline

Jun 24 Reported by CSIRT Italia / ACN
Jun 23 Reported by The Register Security
Jun 19 CISA federal deadline for CVE-2026-48907 passed
Jun 18 CISA federal deadline for CVE-2026-54420 passed
Jun 17 Reported by SecurityWeek
Jun 16 Reported by NCSC-NL Advisories
Jun 16 Reported by Cisco PSIRT
Jun 13 Reported by FortiGuard Labs Threat Signals
Jun 11 Reported by Dark Reading
Jun 9 Reported by TechCrunch Security
Jun 2 Reported by CERT-EU Threat Intelligence
May 22 Reported by Microsoft Security Blog
May 21 Reported by JPCERT/CC

Sources

Jun 24 CSIRT Italia / ACN
Rilevato sfruttamento di vulnerabilità in prodotto Cisco
Rilevato sfruttamento attivo in rete della CVE-2026-20262 presente in Cisco Catalyst SD-WAN Manager, noto software diffuso in ambienti enterprise per l’amministrazione e gestione centralizzata della rete WAN.
original
Jun 23 The Register Security
Cisco SD-WAN make-me-root bug under attack
Second Catalyst SD-WAN Manager flaw exploited as an 0-day this month
original
Jun 17 SecurityWeek
Joomla, LiteSpeed Vulnerabilities Exploited in Attacks
The flaws allow attackers to execute arbitrary PHP code and gain root privileges on shared hosting servers.
original

Part of the PlainSec briefing for 2026-05-14

Every edition of this story: Exploited Joomla and LiteSpeed bugs leave backdoors behind

More from today

Vulnerabilities & Exploits · Web App AttackExploited Joomla and LiteSpeed bugs leave backdoors behindPatching is only the first step here. On Joomla, attackers are using an access-control flaw to create trusted editor profiles and plant persistent web shells. On LiteSpeed shared hosting, a symlink bug lets someone who already has FTP or web-shell access cross into root, so one account foothold can become a host-level compromise.JCE versions before 2.9.99.5 are affected, with extra protections in 2.9.99.6. LiteSpeed’s cPanel plugin is vulnerable in all versions before 2.4.8, and the WHM PlugIn fix is 5.3.2.0. Both flaws are being actively exploited, both are now in CISA’s KEV catalog, and Joomla says public exploit code is already being used in automated attacks.The bigger risk is post-compromise persistence. A patched Joomla site can still carry a rogue profile or web shell, and a patched shared host can still be owned if the attacker already used the symlink path to reach root.21 sources · Jun 24

CVE-2026-48907

NVD KEV

Known exploited · CISA KEV

EPSS 85% (100th percentile).

CISA federal remediation date Jun 19 · date passed

CVE-2026-54420

NVD KEV

Known exploited · CISA KEV

CVSS 8.5 HIGH: liteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks… EPSS 1% (73rd percentile).

CISA federal remediation date Jun 18 · date passed

Timeline

Jun 24 Reported by CSIRT Italia / ACN

Jun 23 Reported by The Register Security

Jun 19 CISA federal deadline for CVE-2026-48907 passed

Jun 18 CISA federal deadline for CVE-2026-54420 passed

Jun 17 Reported by SecurityWeek

Jun 16 Reported by NCSC-NL Advisories

Jun 16 Reported by Cisco PSIRT

Jun 13 Reported by FortiGuard Labs Threat Signals

Jun 11 Reported by Dark Reading

Jun 9 Reported by TechCrunch Security

Jun 2 Reported by CERT-EU Threat Intelligence

May 22 Reported by Microsoft Security Blog

May 21 Reported by JPCERT/CC

Sources

Jun 24 CSIRT Italia / ACN

Rilevato sfruttamento di vulnerabilità in prodotto Cisco

Rilevato sfruttamento attivo in rete della CVE-2026-20262 presente in Cisco Catalyst SD-WAN Manager, noto software diffuso in ambienti enterprise per l’amministrazione e gestione centralizzata della rete WAN.

original

Jun 23 The Register Security

Cisco SD-WAN make-me-root bug under attack

Second Catalyst SD-WAN Manager flaw exploited as an 0-day this month

original

Jun 17 SecurityWeek

Joomla, LiteSpeed Vulnerabilities Exploited in Attacks

The flaws allow attackers to execute arbitrary PHP code and gain root privileges on shared hosting servers.

original

Part of the PlainSec briefing for 2026-05-14Every edition of this story: Exploited Joomla and LiteSpeed bugs leave backdoors behindMore from today

PraisonAI flaw turns exposed agent APIs into targets

npm package update becomes a secret theft vector

SIMATIC HMI panels expose browser access via help link