LiteSpeed released LiteSpeed Web Server Enterprise 6.3.7 build 9 and 6.4.0 RC2 build 7 on 10 November 2026 to fix a critical flaw in how LSWS handles Apache configuration. Under certain configurations, a site could read files outside its document root or run scripts without suEXEC. On CloudLinux servers that means a user can escape CageFS and, in the worst case, get root.
This is the third LiteSpeed security build in two months. Build 8, shipped a week ago for the LSQUIC HTTP/3 flaw, is not enough. Every LSWS Enterprise install needs build 9.
Who is affected
| Item | Detail |
|---|---|
| Product | LiteSpeed Web Server Enterprise only |
| Affected | All versions before the fixed builds |
| Fixed in | 6.3.7 build 9, or 6.4.0 RC2 build 7 on the RC branch |
| Most at risk | Shared hosting using Apache config with suEXEC and CageFS |
| Severity | Critical (vendor rating) |
| CVE | None published at the time of writing |
LiteSpeed has not published the exact configurations that trigger the bug, and there is no documented workaround. Treat every cPanel, Plesk, and DirectAdmin box running LSWS Enterprise as exposed until it reports build 9.
Check and update
The version string stays at 6.3.7 across every build, so read the BUILD file as well:
/usr/local/lsws/bin/lshttpd -v
cat /usr/local/lsws/BUILD
Force the update to the latest 6.3.7 build, restart, and confirm:
/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
/usr/local/lsws/bin/lswsctrl restart
cat /usr/local/lsws/BUILD
BUILD must read 9 or higher. If it still shows 8, your mirror has not picked up the package
yet; retry rather than ticking the host off. You can also update from the WebAdmin console.
Other changes in build 9
- Fixes an infinite-loop corner case in internal HTTP fetches.
- Adds an
autoWhiteListLocalIpsoption to control whether local IPs are whitelisted automatically. LiteSpeed has not yet documented its default, so check behaviour if you rely on local-IP exemptions for anti-DDoS throttling. - 6.4.0 RC2 build 7 also fixes several WebAdmin issues.
Check for compromise
A CageFS escape on a shared server is a whole-server problem, not a single-account one. LiteSpeed recommends looking for unfamiliar processes, files, or cron jobs, and any root-level or cross-account activity. Practical starting points:
- Run a full malware scan and review results with the Imunify360 cleanup workflow.
- List root and per-user crontabs and compare against what you expect.
- Check whether CageFS is still enabled for every user with
cagefsctl --list-disabled.
If you suspect a breach, LiteSpeed advises rotating server credentials plus the database passwords and API tokens stored in hosted accounts. Sites that were cleaned and came back infected are covered in our reinfection hunt guide.
Sources
- LiteSpeed Web Server changelog
- LiteSpeed Technologies critical security advisory emailed 10 November 2026: "LiteSpeed Web Server Security Update: Upgrade to 6.3.7 Build 9"