LiteSpeed cPanel / WHM Plugin — CVE-2026-54420 Symlink-Following Root Privilege Escalation

Looks for: ln -s run from inside a tenant docroot, especially with a target that climbs out of the home tree (../ or an absolute system path). Accomplishes: catches the exploit's symlink-plant primitive. FP: legit deploy scripts create symlinks — tune to non-admin users and out-of-tenant targets.

// HUNT: CVE-2026-54420 symlink plant (tenant runs ln -s in docroot toward system path)
// MITRE: T1574.005, T1222 | CONF: medium  FP: medium  COST: low
// CONF: medium - exploit primitive, but symlinks are also legit in deploy tooling
// FP: medium - CI/deploy and package managers create symlinks
// COST: low - simple process filter
// TUNING: allow-list deploy/admin UserName; focus on ../ or /usr,/etc,/var targets; exclude root
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/\/ln$/
| CommandLine=/\s-s(\s|f|n)/
| CommandLine=/(\.\.\/|\s\/(etc|usr|var|root)\/)/
| CommandLine=/\/home\/[^\/]+\/(public_html|www)/i
| UserName!="root"
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: a binary under /usr/local/lsws or /usr/local/cpanel (e.g. lscpd, lsws, plugin binaries) spawning an interactive shell. Accomplishes: the flagship signal — a privileged plugin process dropping into a shell as root is exactly the post-symlink-follow escalation. Pair with the file-write variant below for root-owned writes.

// HUNT: CVE-2026-54420 privileged LiteSpeed/cPanel process spawns shell (post symlink-follow)
// MITRE: T1548, T1222 | CONF: high  FP: low  COST: low
// CONF: high - the plugin daemon has no business launching an interactive shell
// FP: low - rare; some plugin maintenance spawns sh - confirm command + timing
// COST: low - narrow parent-path filter
// TUNING: allow-list known plugin install/update child commands if baselined
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(lscpd|lsws|litespeed|lshttpd)$/i
| ImageFileName=/\/(sh|bash|dash|python[0-9.]*|perl)$/
| UserName="root"
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine], limit=200)

Looks for: the web/php service account (nobody, _lsphp, nginx, apache) spawning sh/bash or recon binaries (id, whoami, uname). Accomplishes: catches the web-shell foothold that delivers the symlink plant. FP: a few sites legitimately shell out — exclude known apps/cron.

// HUNT: CVE-2026-54420 web-shell behavior (php/web user spawns shell + recon)
// MITRE: T1505.003 | CONF: high  FP: low-medium  COST: low
// CONF: high - php/web service accounts should not run interactive recon
// FP: low-medium - some CMS plugins shell out - baseline per host
// COST: low - process filter on a small set of users
// TUNING: allow-list known app helper commands; exclude scheduled/cron parents
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| UserName=/^(nobody|_lsphp|nginx|apache|www-data|httpd)$/i
| ImageFileName=/\/(sh|bash|dash|id|whoami|uname|wget|curl)$/
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine], limit=200)

Looks for: file writes to cron directories, systemd unit paths, SSH authorized_keys, or /etc/passwd / /etc/shadow. Accomplishes: catches the persistence stage that follows a successful root escalation. FP: legit config management edits these — scope to hosts with a recent Q2/Q3 hit and exclude config-management agents.

// HUNT: CVE-2026-54420 post-root persistence (cron/systemd/authorized_keys/passwd write)
// MITRE: T1053.003, T1543.002, T1098.004 | CONF: medium  FP: medium  COST: low
// CONF: medium - strong if correlated to a same-host Q2/Q3 escalation
// FP: medium - config management (ansible/puppet/cpanel) writes these paths
// COST: low - file-event path filter
// TUNING: scope to hosts with a recent Q2/Q3 hit; allow-list config-mgmt + cpanel updaters
#event_simpleName=/NewExecutableWritten|FileCreate/
| TargetFileName=/(\/etc\/cron|\/etc\/systemd\/system\/|\/lib\/systemd\/system\/|\/\.ssh\/authorized_keys|\/etc\/passwd|\/etc\/shadow)/
| UserName!=/^(_cpanel|cpanel)$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, TargetFileName], limit=200)

Looks for: a chmod setting the setuid/setgid bit (u+s, g+s, or numeric 4xxx/2xxx) run from a non-admin/web/tenant user, or a copy of a shell into a SUID path. Accomplishes: catches a classic post-root SUID-backdoor drop. FP: low — most SUID changes are admin/install-time.

// HUNT: CVE-2026-54420 SUID/SGID backdoor (chmod u+s from non-admin context)
// MITRE: T1548.001 | CONF: high  FP: low  COST: low
// CONF: high - web/tenant accounts have no reason to set the setuid bit
// FP: low - package installs set SUID but run as root/pkg user - exclude those
// COST: low - process filter
// TUNING: allow-list package-manager parents (rpm/yum/dnf); keep non-admin UserName
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/\/chmod$/
| CommandLine=/(u\+s|g\+s|\s[24][0-7]{3}(\s|$))/
| UserName!="root"
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: an outbound connection to a public IP whose initiating process is a web/php/shell binary running under a web service account. Accomplishes: surfaces reverse shells and second-stage tool downloads. FP: sites make legit outbound API calls — exclude RFC1918 + sanctioned destinations and correlate to a same-host Q3/Q2.

// HUNT: CVE-2026-54420 egress from web/php process (reverse shell / tool pull)
// MITRE: T1071.001 | CONF: medium  FP: medium  COST: medium
// CONF: medium - meaningful when the process is a shell, not the app itself
// FP: medium - many sites call external APIs/CDNs outbound
// COST: medium - network event volume
// TUNING: exclude RFC1918 + sanctioned API/CDN ranges; correlate to a same-host Q3/Q2
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(sh|bash|dash|python[0-9.]*|perl|lsphp|php)$/i
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|127\.)/
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)