LiteSpeed 6.3.7 Build 9: CageFS/suEXEC Escape - BUILD 8 Is Not This Patch

LiteSpeed Web Server 6.3.7 build 9 (released 10 November 2026) and 6.4.0 RC2 build 7 (same day) both list one security line: Enhance Apache configuration handling to prevent unauthorized file access beyond the document root and running scripts without suEXEC (CageFS escape). The public changelog does not assign a CVE, a CVSS, a CWE, the word critical, or an exploit status. CISA KEV catalog 2026.11.10 (1,779 entries) has no matching LiteSpeed / CageFS / suEXEC row for this issue.[1][3]

If lshttpd -v already prints 6.3.7 and BUILD is 8, you are not done. Build 8 (3 November) is the LSQUIC HTTP/3 line. This is a different patch, six days later, on the same version string.[1]

What it is

LiteSpeed Enterprise on cPanel / Plesk / DirectAdmin reads Apache configuration (vhosts, includes, .htaccess) and maps that onto its own worker: document root, uid for CGI/PHP (suEXEC), and - on CloudLinux - whether the request stays inside CageFS.

The changelog names the bug class in one sentence: Apache-config handling could allow file reads outside the document root and scripts running without suEXEC, with a parenthetical CageFS escape. It does not name a directive, a .htaccess trick, a CVE, or a privilege after escape. We are not filling that in from host-blog copies of a customer email.[1]

This is not:

The September lscgid / CageFS tenant-to-root on Enterprise before 6.3.7 (cPanel advisory 14 September 2026; floor was the version, then build 2). Different changelog bullets (lscgid auth, internal redirect, .htaccess env vars).[4]
6.3.7 build 8 / 6.4 RC2 build 6 / ADC 3.3.4 - critical LSQUIC. Different component, different date.[1][2]
CVE-2026-104474 (OpenLiteSpeed lsup.sh unpacks a nobody-writable tarball as root; floor 1.9.3).[5]
LiteSpeed cPanel plugin KEV rows CVE-2026-54420 / CVE-2026-48172 (2026-06 / 2026-05). Those are the WHM plugin, not this Apache-config line.[3]

How the engine bug reads - inference, not a vendor write-up. suEXEC is the switch that makes PHP/CGI run as the tenant uid instead of the web-server identity. CageFS wraps that tenant uid in a filesystem jail. If Apache-config handling can skip suEXEC, the script never enters the jail, because the jail is applied to the account process, not to a privileged worker that decided not to drop. File access beyond document root is the same class of mapping error: the vhost’s root is not the root the worker actually used. That is a reading of the published sentence. It is not a PoC.

How serious is it?

The vendor sentence is CageFS escape plus scripts without suEXEC plus files beyond document root. That is a shared-hosting isolation failure. The changelog does not say critical, root, unauthenticated, or exploited. Reseller pages that add those words are not the vendor changelog; we are not adopting them as ours.

There is no CVE ID on the pages we pulled, so there is no NVD Primary / CISA ADP score to cite. It is not on KEV.[1][3]

September’s cPanel advisory did say a low-privilege website user could potentially gain root. This November line does not repeat that. Do not upgrade “CageFS escape” into “same as September, therefore root” without a vendor sentence.

Who is affected

In scope from the public changelogs we fetched:

LiteSpeed Web Server Enterprise 6.3.x - floor 6.3.7 build 9 (10 Nov 2026).[1]
LiteSpeed Web Server Enterprise 6.4 RC - floor 6.4.0 RC2 build 7 (10 Nov 2026).[1]

Treat every 6.3.7 build ≤ 8 and every 6.4.0 RC2 build ≤ 6 as not this patch. Build 8 patched LSQUIC. It did not contain this Apache-config line.

The changelog does not publish a last-affected version below 6.3.7. If you are still on 6.3.6 or older, you already had other security floors - still move to 6.3.7 build 9, not “any 6.3.7.”

Most relevant topology (from the wording, not a census): panel boxes that feed LSWS Apache configuration and run suEXEC, especially CloudLinux CageFS shared hosts. The changelog names those mechanisms. Dedicated single-tenant boxes still have a document-root and suEXEC mapping; patch them anyway. Do not wait for a “shared-only” carve-out LiteSpeed did not print.

LiteSpeed Web ADC: public log through 3.3.4 (4 November 2026) is the LSQUIC / Brotli line. It does not contain the Apache-config / suEXEC / CageFS sentence. ADC is not a suEXEC/CageFS origin. We will not invent an ADC floor for this bug.[2]

OpenLiteSpeed: public 1.9.4 notes (26 October 2026) list webadmin default-off, admin_php for PHP2Shell, and Brotli 1.2.1. They do not contain this CageFS/suEXEC sentence. Current 1.9.x tag we fetched is still 1.9.4. That is not proven as this fix. Check OLS again after LiteSpeed publishes, or ask LiteSpeed.[6]

What to do now

Read VERSION and BUILD. 6.3.7 with build 8 is the trap this week. Vendor changelog shows cat lsws/BUILD. Updates doc also mentions /usr/local/lsws/autoupdate/build. Read both if they disagree.[1][7]

/usr/local/lsws/bin/lshttpd -v
cat /usr/local/lsws/VERSION
cat /usr/local/lsws/BUILD
cat /usr/local/lsws/autoupdate/build

Want: version 6.3.7 and BUILD 9 (or higher), or 6.4.0 RC2 with BUILD 7+.

Force the edge build of 6.3.7. Vendor’s own changelog header is this command.[1][7]

/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
cat /usr/local/lsws/BUILD
/usr/local/lsws/bin/lshttpd -v

On cPanel you can also update from the LiteSpeed WHM plugin; still confirm BUILD, not the plugin “6.3.7” label.

Put Stable-tier follow back if you use cron lsup.sh. -f -v removes /usr/local/lsws/autoupdate/follow_stable. Until you touch it again, a parameter-less cron lsup.sh does nothing. That is documented, not a guess.[7]

touch /usr/local/lsws/autoupdate/follow_stable

Expect stricter HTTP authentication. Build 9 also enforces stricter HTTP authentication. That is a tuning line, not the security fix - but .htpasswd / Digest / panel-protected dirs are the tickets you will get after the restart. Check one protected path per box before you walk away.[1]
autoWhiteListLocalIps is new. Changelog adds a config knob to control whitelisting of local IPs. LiteSpeed has not documented the default on this page. If you rely on local-IP exemptions for anti-DDoS or internal probes, verify behaviour after the restart instead of assuming it stayed the same.[1]
No workaround on the changelog. We are not publishing a “disable Apache config / native-only” recipe as a vendor fix. Patch is the action LiteSpeed printed.
After BUILD is 9: confirm the process actually restarted (lswsctrl status / a new pid), and that /usr/local/lsws/logs/error.log is not looping on a failed binary. Clusters are per-node.

Versions with no floor

EOL 5.x / abandoned 6.2 trains are not going to grow a build 9. Move the server onto 6.3.7 build 9 (or current 6.4 RC build 7 if you already chose RC). Staying on 6.3.7 build 2 because you patched lscgid in September, or build 8 because you patched LSQUIC last week, is not this patch.

OpenLiteSpeed: no CageFS/suEXEC floor on the 1.9.x log we fetched. Do not invent one.

ADC: no matching line through 3.3.4. Do not invent one.

Compromise signs

None of these prove this bug. The changelog gives no IoC.

BUILD still ≤ 8 on 6.3.7 on a CloudLinux + CageFS shared host.
PHP/CGI processes for a tenant running as nobody / apache / lsadm instead of the account uid (ps -o user,pid,cmd -C lsphp / lveinfo). Many configs do that on purpose; it is a check, not a verdict.
Unexpected files readable across accounts, or CageFS cagefsctl --list-disabled showing users you did not disable.
Unfamiliar root / user crontabs, new SSH keys, Imunify hits after 10 November.

Absence of a log line proves nothing. There is no CVE-specific signature to grep.

FAQ

Is there a CVE? Not on the LSWS changelog we pulled. If LiteSpeed publishes an ID later, map it to build 9 / 6.4 RC2 build 7, not to “any 6.3.7” and not to build 8.[1]

Is it on CISA KEV? No. Catalog 2026.11.10, 1,779 entries. Newest adds we saw are Microsoft Outlook CVE-2026-124194, Chromium CVE-2026-125350, Barracuda ESG CVE-2026-116606 / CVE-2026-111560, Cisco BroadWorks CVE-2026-20320, Openwave CVE-2026-111793 (10 Nov) - unrelated. Older LiteSpeed plugin KEV rows are not this bug.[3]

Is this the September CageFS root? No. September was lscgid / internal redirect / .htaccess env, floor 6.3.7 (then build 2). This is Apache-config handling, floor build 9, no CVE, no “root” on the public page.[1][4]

Is BUILD 8 enough? No. Build 8 is LSQUIC. Build 9 is this line. Same 6.3.7 string.[1]

Does ADC / OLS need this? Public ADC 3.3.4 and OLS 1.9.4 do not contain this sentence. Do not copy reseller pages that lump all three products into one floor.[2][6]

Did -f -v break my nightly lsup.sh? Yes, until you touch follow_stable again. Same as last week’s LSQUIC run.[7]

Honesty

We did not reverse LSWS Apache-config parsing, escape CageFS, or produce a PoC.
“CageFS escape” / “without suEXEC” / “beyond the document root” are the changelog words. No CVSS from NVD/CISA on this row because no CVE is listed there. The changelog does not say critical (unlike the LSQUIC line six days earlier).
Host/reseller write-ups that quote critical, root, or a customer-mail date are not the vendor changelog. We did not receive LiteSpeed’s customer mail. We are not repeating those numbers as ours.
OpenLiteSpeed 1.9.4 is not claimed as this patch from the OLS 1.9.x log.
ADC 3.3.4 is the LSQUIC floor, not this bug.
KEV count 1,779 / catalog 2026.11.10 from the JSON we saved this morning.

Sources

LiteSpeed Web Server changelog - 6.3.7 Build 9 and 6.4.0 RC2 Build 7, both 10 Nov 2026, “[Security] Enhance Apache configuration handling to prevent unauthorized file access beyond the document root and running scripts without suEXEC (CageFS escape)”; header commands cat lsws/BUILD and lsup.sh -f -v 6.3.7; Last-Modified: Tue, 10 Nov 2026 17:00:32 GMT on the HTML we fetched
LiteSpeed Web ADC changelog - Version 3.3.4, 4 Nov 2026, LSQUIC / Brotli only; no CageFS/suEXEC line
CISA KEV JSON - catalogVersion 2026.11.10, count 1779; no LSWS CageFS/suEXEC row; plugin KEV CVE-2026-54420 / CVE-2026-48172 are older
ServerGurus: LiteSpeed Enterprise 6.3.7 CageFS - September lscgid/CageFS floor, different bug
CVE-2026-104474 - OpenLiteSpeed lsup.sh LPE, floor 1.9.3
OpenLiteSpeed 1.9.x release log - V1.9.4 dated 2026-10-26, no CageFS/suEXEC line
Updates with lsup - -f / -v / -b, follow_stable marker behaviour
ServerGurus: LiteSpeed 6.3.7 Build 8 LSQUIC - previous floor, still required, not this patch