CVE-2026-54420 Microsoft Sentinel · KQL

Detect LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability in Microsoft Sentinel

Detects exploitation of CVE-2026-54420, a UNIX symbolic link (symlink) following vulnerability in the LiteSpeed cPanel Plugin. Attackers with local access can create malicious symlinks to read or overwrite files outside the intended directory, potentially leading to privilege escalation or unauthorized file access on cPanel-managed hosting servers. This vulnerability is actively exploited in the wild (CISA KEV).

MITRE ATT&CK

Tactic
Privilege Escalation Defense Evasion Credential Access

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let timeframe = 1h;
let litespeed_paths = dynamic(['/usr/local/lsws', '/opt/cpanel/ea-php', '/etc/lsws', '/var/lsws']);
let sensitive_targets = dynamic(['/etc/passwd', '/etc/shadow', '/root/', '/home/', '/etc/ssh/', '/etc/sudoers']);
union
(
    DeviceFileEvents
    | where TimeGenerated >= ago(timeframe)
    | where ActionType in ('FileCreated', 'FileModified')
    | where FolderPath has_any (litespeed_paths)
    | where FileType == 'SymbolicLink'
    | extend TargetPath = tostring(parse_json(AdditionalFields).SymlinkTarget)
    | where TargetPath has_any (sensitive_targets)
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, FolderPath, FileName, TargetPath, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType
),
(
    DeviceProcessEvents
    | where TimeGenerated >= ago(timeframe)
    | where ProcessCommandLine matches regex @'ln\s+-s'
    | where InitiatingProcessFileName in~ ('lsup.sh', 'lsphp', 'litespeed', 'lshttpd', 'cpanel-plugin')
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
)
| extend AlertSeverity = 'High'
| extend Recommendation = 'Update LiteSpeed cPanel Plugin immediately. Investigate symlink targets for unauthorized file access.'
| order by TimeGenerated desc
high severity medium confidence

Detects symbolic link creation in LiteSpeed cPanel Plugin directories pointing to sensitive system files, and symlink commands spawned by LiteSpeed processes. Covers both file event telemetry and process execution telemetry for breadth.

Data Sources

Microsoft Defender for EndpointMicrosoft SentinelDeviceFileEventsDeviceProcessEvents

Required Tables

DeviceFileEventsDeviceProcessEvents

False Positives & Tuning

  • Legitimate LiteSpeed plugin updates that create internal symlinks during installation or upgrade
  • cPanel or WHM administrative scripts performing routine maintenance that involve symlinking PHP binaries
  • Hosting provider automation tools that manage multi-PHP environments using symlinks
  • Security scanning tools that enumerate symlinks as part of configuration audits

Other platforms for CVE-2026-54420

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Create Malicious Symlink in LiteSpeed Plugin Directory Targeting /etc/shadow

    Expected signal: auditd SYSCALL=symlink with a1 pointing to /etc/shadow; FileOpenInfo event on /etc/shadow via the symlink path; process creating the symlink is a non-root user

  2. Test 2Symlink Traversal via LiteSpeed Binary Process Simulation

    Expected signal: SYSCALL=symlink event for the ln -sv command; stat and readlink syscalls on the symlink; auditd logs should capture the effective UID and process name

  3. Test 3Enumerate LiteSpeed Plugin Directory and Create Targeted Symlink Chain

    Expected signal: Multiple syscall events: find spawning openat calls on LiteSpeed paths; SYSCALL=symlink for the ln command; readdir on /root/.ssh via the symlink (if permitted); auditd AVC denials if SELinux/AppArmor active

Last updated: 2026-06-19 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify the affected cPanel server(s) by correlating the alert with asset inventory — confirm LiteSpeed cPanel Plugin is installed and determine the installed version against the vendor advisory at https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/
  2. Enumerate all symlinks created in LiteSpeed directories (e.g., /usr/local/lsws, /var/lsws, /etc/lsws) within the alert window: `find /usr/local/lsws /var/lsws /etc/lsws -type l -ls` and compare symlink targets against sensitive paths (/etc/shadow, /root/, /etc/ssh/)
  3. Review the ownership and permissions of any suspicious symlinks and determine which user account created them — check if the account is a cPanel hosting user (lower privilege) or a server administrator account
  4. Query auditd logs or /var/log/audit/audit.log for SYSCALL=symlink or SYSCALL=symlinkat events around the alert timestamp, filtering by the process name (lsphp, lshttpd) and effective UID
  5. Assess whether any sensitive file was read or written via the symlink by reviewing file access logs and checking file modification timestamps on targets such as /etc/shadow

Containment

  1. Immediately remove any malicious symlinks identified during triage using `rm -f <symlink_path>` and restore correct permissions on targeted sensitive files if they were modified
  2. Disable the LiteSpeed cPanel Plugin or place the affected web server in maintenance mode until the patched plugin version is applied — coordinate with the hosting team to apply the vendor security update from the LiteSpeed advisory
  3. If unauthorized file access is confirmed (e.g., /etc/shadow was read), rotate all credentials for accounts whose password hashes may have been exposed, and immediately revoke any SSH keys that may have been accessed
  4. Isolate the cPanel server from external traffic if active exploitation of the exposed credentials is suspected, pending a full forensic review

Evidence Collection

  1. Collect a full listing of symlinks under LiteSpeed directories with metadata: `find /usr/local/lsws /opt/cpanel /var/lsws /etc/lsws -type l -printf '%T@ %p -> %l\n' | sort -n > /tmp/lsws_symlinks_evidence.txt`
  2. Export auditd logs covering the exploitation window: `ausearch -ts $(date -d '2 hours ago' +'%H:%M:%S') -te now --raw > /tmp/audit_evidence.log` and preserve the raw log for forensic analysis
  3. Capture process tree at time of alert from EDR telemetry or `ps auxf` output, and collect `/proc/<pid>/maps` and `/proc/<pid>/cmdline` for any LiteSpeed processes active during the window
  4. Preserve a copy of the current /etc/passwd and /etc/shadow (with restricted permissions) and compare against known-good baseline from backup to detect unauthorized modifications

Escalation Criteria

  • !Escalate to Incident Response if /etc/shadow or SSH private keys were confirmed to be read via the symlink — this indicates potential credential compromise across all hosted accounts on the server
  • !Escalate if the exploiting user account is a shared hosting tenant (unprivileged cPanel user) that successfully accessed root-owned files, as this indicates privilege escalation beyond the intended sandbox
  • !Escalate if multiple servers across the hosting environment are affected simultaneously, indicating automated exploitation consistent with a worm or coordinated attack campaign
  • !Escalate if any evidence of lateral movement or persistence (new cron jobs, SSH key additions, web shells) is found on the compromised server following the symlink exploitation

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Auditd SYSCALL records for symlink and symlinkat with AUID of the attacking cPanel user
  • >LiteSpeed error log at /usr/local/lsws/logs/error.log — may contain path traversal attempts or unusual file access errors around the exploitation window
  • >cPanel access logs at /usr/local/cpanel/logs/access_log for the affected user account showing plugin interactions
  • >File inode change timestamps (ctime) on /etc/shadow, /etc/passwd, or /etc/ssh/ — an unexpected ctime change indicates the file was accessed via the symlink
  • >Bash history for the compromised cPanel user: ~/.bash_history — may contain ln -s commands or reconnaissance commands

Tuning Guidance

Start with high-confidence signals: symlinks created by non-root LiteSpeed process users (lsadm, nobody, www-data) pointing directly to /etc/shadow or /etc/ssh are near-certain exploitation. Reduce noise by filtering out known-good upgrade processes — whitelist the lsup.sh script when run as root with a parent process of the cPanel update daemon (cpaneld). For environments with heavy cPanel automation, build a baseline of expected symlink targets per LiteSpeed directory over 30 days and alert only on deviations. Correlate with cPanel user login events to confirm the symlink creator is an active hosted tenant rather than a server administrator.

Hunting Queries

Hunt for anomalous bursts of symlink creation activity (more than 3 per hour) in LiteSpeed-related directories across the past 7 days, which may indicate automated exploitation or scanning for vulnerable targets

Hunting — KQL
kql 
DeviceFileEvents
| where TimeGenerated >= ago(7d)
| where FileType == 'SymbolicLink'
| where FolderPath has_any ('/usr/local/lsws', '/var/lsws', '/etc/lsws', '/opt/cpanel')
| extend SymlinkTarget = tostring(parse_json(AdditionalFields).SymlinkTarget)
| summarize SymlinkCount=count(), Targets=make_set(SymlinkTarget), Initiators=make_set(InitiatingProcessAccountName) by DeviceName, bin(TimeGenerated, 1h)
| where SymlinkCount > 3
| order by SymlinkCount desc
Hunting — SPL
spl 
index=os sourcetype IN ("linux_audit", "auditd") syscall IN ("symlink", "symlinkat")
| eval path=coalesce(nametype, path)
| search path IN ("/usr/local/lsws*", "/var/lsws*", "/etc/lsws*", "/opt/cpanel*")
| stats count AS symlink_count, values(path) AS paths, values(auid) AS users BY host, span(_time, 1h)
| where symlink_count > 3
| sort -symlink_count

Atomic Red Team Tests

Test 1 Create Malicious Symlink in LiteSpeed Plugin Directory Targeting /etc/shadow
linux

Simulates a cPanel tenant user creating a symlink inside a LiteSpeed writable directory that points to /etc/shadow, then reading the file through the symlink to confirm exploitation.

Command

bash 
mkdir -p /tmp/lab_lsws_plugin && ln -s /etc/shadow /tmp/lab_lsws_plugin/shadow_link && cat /tmp/lab_lsws_plugin/shadow_link | head -5

Cleanup

bash 
rm -f /tmp/lab_lsws_plugin/shadow_link && rmdir /tmp/lab_lsws_plugin

Expected Telemetry

auditd SYSCALL=symlink with a1 pointing to /etc/shadow; FileOpenInfo event on /etc/shadow via the symlink path; process creating the symlink is a non-root user

Expected Detection

Alert fires on symlink creation with sensitive target path /etc/shadow; subsequent file read event on the symlink path should correlate in SIEM

Test 2 Symlink Traversal via LiteSpeed Binary Process Simulation
linux

Simulates a compromised lsphp process creating a symlink to /etc/passwd within a plugin-writable directory, as would occur if the LiteSpeed plugin fails to validate symlink targets before privilege operations.

Command

bash 
mkdir -p /tmp/lab_lsws/lsphp.d && ln -sv /etc/passwd /tmp/lab_lsws/lsphp.d/passwd_link && stat /tmp/lab_lsws/lsphp.d/passwd_link && readlink -f /tmp/lab_lsws/lsphp.d/passwd_link

Cleanup

bash 
rm -f /tmp/lab_lsws/lsphp.d/passwd_link && rm -rf /tmp/lab_lsws

Expected Telemetry

SYSCALL=symlink event for the ln -sv command; stat and readlink syscalls on the symlink; auditd logs should capture the effective UID and process name

Expected Detection

SPL and KQL queries fire on the symlink creation pointing to /etc/passwd from a non-standard lsphp directory; EQL sequence rule may trigger if followed by a file access event

Test 3 Enumerate LiteSpeed Plugin Directory and Create Targeted Symlink Chain
linux

Simulates the full attacker workflow: discovering writable LiteSpeed directories, creating a symlink chain to escalate from a plugin directory to SSH private key material.

Command

bash 
find /usr/local/lsws /var/lsws /etc/lsws -writable -type d 2>/dev/null | head -5; mkdir -p /tmp/lab_attack && ln -s /root/.ssh /tmp/lab_attack/ssh_keys_link && ls -la /tmp/lab_attack/ssh_keys_link/ 2>/dev/null || echo 'Access denied (expected in hardened env)'

Cleanup

bash 
rm -f /tmp/lab_attack/ssh_keys_link && rmdir /tmp/lab_attack

Expected Telemetry

Multiple syscall events: find spawning openat calls on LiteSpeed paths; SYSCALL=symlink for the ln command; readdir on /root/.ssh via the symlink (if permitted); auditd AVC denials if SELinux/AppArmor active

Expected Detection

CrowdStrike CQL and Sumo Logic queries fire on the ln command with /root/.ssh as target; Chronicle YARAL rule triggers on FILE_CREATION event with symlink_target_path matching /root/; hunt query may surface the find enumeration as precursor activity

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0005Defense EvasionTA0006Credential Access

Related Techniques

T1574Hijack Execution FlowT1548Abuse Elevation Control MechanismT1083File and Directory Discovery

Same Tactic: Privilege Escalation

Popular Detections