Weekly Cybersecurity Summary – 11 September to 17 September 2026

The Heart Internet Team are aware of several security issues affecting web hosting infrastructure this week, and we want to help customers understand what they mean, who may be affected, and what sensible steps to take. This week we’re covering four issues: two critical command injection flaws in a firewall tool used on a large share of cPanel/WHM servers, an account-isolation bypass in LiteSpeed Web Server Enterprise, an actively exploited backup-plugin flaw affecting cPanel/WHM and Plesk deployments, and a newly disclosed WordPress plugin vulnerability that allows unauthenticated administrator account takeover.

ConfigServer Security & Firewall, commonly known as CSF, is a firewall and intrusion detection suite used on a large proportion of cPanel and WHM servers. On 10 September 2026, researchers disclosed two separate command injection vulnerabilities in CSF. The first, CVE-2026-65638, lies in CSF’s MESSENGER service, a feature that displays a message to visitors who have been blocked by the firewall; it fails to properly escape part of the request URL before passing it to a shell command, so an unauthenticated attacker can inject and run arbitrary commands. It only applies when MESSENGER and a reCAPTCHA secret are both configured, which is not the default setup. The second, CVE-2026-65639, sits in CSF’s advanced-rule parser: if an attacker can control a configured allow or deny feed, insufficient validation of the feed data lets them run arbitrary commands as root.

On shared hosting, a successful attack against a server-wide firewall tool like CSF could affect every website on that server, not just one account, since the compromise happens at root level. On VPS and dedicated servers, the practical risk is lower unless MESSENGER with reCAPTCHA is deliberately configured, or the server pulls IP block lists from a feed an attacker could influence, but the potential impact if either applies is severe.

Update CSF to 16.30 or later on any server where it is installed. If MESSENGER is enabled, disable it until the update is confirmed applied.

cPanel published an advisory on 14 September 2026 warning that LiteSpeed Web Server Enterprise, widely used as a faster alternative to Apache on shared hosting, contains a flaw that lets a malicious low-privilege hosting account escape the isolation controls meant to keep customer accounts separate, including CageFS, and potentially reach root on the underlying server. Neither cPanel nor LiteSpeed have published technical detail on how the flaw works, and as of publication no CVE identifier has been assigned to it, which is unusual for an issue of this severity. This is reportedly the third LiteSpeed account-isolation flaw disclosed in four months.

This is specifically a shared-hosting risk, since it depends on multiple customer accounts sharing one server, which is exactly the CageFS model. VPS and dedicated server users, where each customer already has their own isolated environment, are not affected by this particular flaw.

Update LiteSpeed Web Server Enterprise to 6.3.7 or later on every affected server as a priority.

Acronis disclosed on 15 September 2026 that its Backup plugin for cPanel & WHM and its Backup extension for Plesk contain a local privilege escalation flaw caused by incorrect default file permissions. Acronis confirmed that exploitation has already been detected in the wild, in limited and targeted attacks against cPanel & WHM deployments; no exploitation against Plesk deployments has been reported so far. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 16 September 2026.

Exploitation requires an attacker to already have some form of local, low-privilege access to the server, for example through a compromised hosting account, weak credentials, or a vulnerable web application. From there, this flaw could let them escalate to read backup data, system files, or other accounts on a shared server.

Update the Acronis Backup plugin/extension to the fixed build on any server where it is installed, and review access logs for signs of unexpected privilege changes.

A vulnerability disclosed on 17 September 2026 in the WordPress plugin “Login with QR” (versions up to and including 1.0.0) allows any unauthenticated visitor to log in as any user on the site, including administrators. The plugin is meant to let a user log in by scanning a QR code, but it fails to verify that the code presented is one it actually issued, instead accepting any code that matches a stored value, which an attacker can guess or generate themselves. No fixed version has been published yet.

If a website owner has this plugin installed and active, an attacker could gain full administrative control of that WordPress site without needing any credentials.

Deactivate and remove the plugin immediately on any site where it is installed, until a fixed version is released.

If you have any questions about these issues or need help checking your account, please raise a support ticket via the Customer Area at heartinternet.uk, or use live chat, available Monday to Friday, 09:30 to 16:00. You can also find more guidance in our knowledge base at heartinternet.uk/support. We’re here to help if you’re not sure whether any of this affects you.