The 'cPanel Backdoor Blitz' (CAMP-2026-050) has reached a critical new phase with the discovery and active exploitation of CVE-2026-48172. This vulnerability, which impacts the LiteSpeed User-End cPanel Plugin, is a textbook example of 'Incorrect Privilege Assignment' that leads to total system compromise. According to technical analysis from The Hacker News, any cPanel user—including a low-privileged account or a previously compromised one—can leverage this flaw to execute arbitrary scripts with root permissions. In the context of shared hosting, where a single physical server may host hundreds or even thousands of individual websites, this is a catastrophic scenario. An attacker who gains access to a single site can now 'break out' of the user jail and take control of the entire server, accessing the data and credentials of every other tenant on the machine. This is the ultimate 'Blast Radius' event for the hosting industry. We have observed a surge in scanning activity targeting this specific plugin, with threat actors using automated kits to identify vulnerable servers and deploy the 'Filemanager' backdoor we reported on May 12th. The actor 'Mr_Rot13' appears to be the primary driver behind this campaign, shifting their focus from cPanel's core vulnerabilities to its widely used third-party plugins. This reflects a strategic pivot: as core software becomes more resilient, attackers are targeting the 'Trust Anchors' of the ecosystem—the plugins and extensions that often have less rigorous security audits. The technical nature of the exploit involves a logic flaw in how the plugin handles user-submitted scripts during the optimization process. By crafting a specific request, an attacker can trick the plugin into executing their code within the context of the root-level LiteSpeed process. This bypasses all OS-level permissions and security modules like SELinux or AppArmor, as the process itself is already running with the highest possible privileges. The speed of exploitation is breathtaking; within hours of the vulnerability's disclosure, PoC code was circulating on underground forums, and active exploitation was confirmed by multiple hosting providers. This reinforces our 'Death of the Patch Window' thesis from earlier this week. For hosting providers, the directive is clear: update the LiteSpeed plugin immediately or disable it. There is no middle ground. The financial exposure for providers who fail to act is immense, not just from the risk of ransomware, but from the legal and reputational fallout of a multi-tenant breach. This incident also highlights the need for better 'Shadow Mitigation'—the ability for vendors to push emergency detections to EDR and WAF platforms before a full patch can be deployed. As we continue to track CAMP-2026-050, we expect to see further targeting of the cPanel ecosystem as attackers look for the next weak link in the shared hosting chain.