LiteSpeed zero-day at Hostinger: what happened and what you should do

According to a report published on 10 November 2026, a Hostinger shared hosting server in Phoenix (USA) was attacked: first a customer website was compromised, then a previously unknown flaw in the LiteSpeed web server was used. Below is a summary of the incident and what you can do to protect your own site.

How did the attack unfold?

• 5 November: The attacker took over a vulnerable content management system (CMS) on a customer website on the server.
• Using an unknown LiteSpeed flaw, the attacker then bypassed CloudLinux CageFS, which separates accounts from each other, and gained administrator (root) access to the server.
• The code ran as the web server user, so its activity blended in with normal traffic.
• About 400 accounts were exposed to code execution and to the reading of database credentials and access tokens.

What did Hostinger do?

• Its monitoring flagged suspicious activity on 8 November and the incident was declared on 9 November.
• The attacker's access was removed, internal credentials were rotated and evidence was preserved for forensic analysis.
• The affected server was taken offline; accounts were moved to other servers and restored from backups made before the attack.
• Affected customers were emailed individually and the competent authority was notified.
• According to Hostinger, there was no evidence that its backup system, internal management systems or account login systems were affected.

What is still unknown

The report does not give the CVE number, the affected and fixed versions, or indicators of compromise. Hostinger says it is working with LiteSpeed on a permanent fix and will update its report. Details may change.

What can you do?

1. Keep your CMS (WordPress etc.), themes and plugins up to date and delete the ones you do not use. The first link in the attack chain was a vulnerable website.
2. Change your database passwords and API keys regularly, and immediately if your hosting provider reports an incident.
3. Use strong passwords and two-factor authentication on admin accounts.
4. Make regular backups and keep a copy outside your hosting.
5. Check your site for files or admin accounts you do not recognise.
6. Read security emails from your provider carefully.

If you get stuck, open a support ticket.

Source

This article is our own summary of Hostinger's statement as reported by webhosting.today. We have not separately reviewed Hostinger's official blog post.