In early November 2026, LiteSpeed Technologies issued an urgent security advisory about a critical flaw in LiteSpeed Web Server and OpenLiteSpeed, the web server software that powers millions of websites worldwide, including a large share of WordPress sites.
If your website is hosted with InfaCloud, you don’t need to do anything. Every one of our LiteSpeed servers was updated on 5 November, the same morning the warning came in, and well ahead of LiteSpeed’s planned public release of the technical details on 16 November. Here’s what happened and how we got ahead of it.
What Is The LiteSpeed Vulnerability?
The flaw is in LSQUIC, the part of LiteSpeed that handles HTTP/3. HTTP/3 is the newest way for browsers to talk to websites, and it’s what helps pages load quickly, especially on mobile connections.
LiteSpeed has rated the flaw as critical, with a severity score of 9.2 out of 10. It can be attacked over the internet without a password. At best it could crash a web server. At worst it could let an attacker run their own code on it.
As with the PHP security alert in October, the problem sits in the server software itself, not in WordPress or any plugin. Updating your website won’t fix it. The fix has to be installed on the server, and that’s a job for your hosting provider.
What LiteSpeed Does For Our Clients
We chose LiteSpeed to run our hosting because it makes our clients’ websites faster and more reliable than a standard web server. Every website we host runs on it, and here’s what it does for you day to day:
- Faster pages. LiteSpeed works hand in hand with the LiteSpeed Cache plugin for WordPress, which we set up on our clients’ sites. It saves a ready-made copy of each page, so visitors get it instantly instead of waiting for it to be built every time.
- Quicker loading on phones. LiteSpeed supports HTTP/3, the newest way for browsers to connect to websites. It copes much better with patchy mobile signal, so your site feels quicker for customers on the move.
- Handles busy periods. LiteSpeed can serve far more visitors at once than older web servers, so a busy Christmas, a sale or a post that takes off on social media doesn’t slow your site to a crawl.
- Better for Google. Page speed is part of how Google ranks websites. A faster site helps your search rankings and keeps visitors from giving up and going back to the search results.
- Built-in protection. LiteSpeed works alongside our server firewall to block common attacks, such as bots trying to guess WordPress passwords, before they reach your website.
That’s why keeping LiteSpeed up to date matters so much. It’s the engine every one of our clients’ websites runs on.
How We Secured Our Servers Before The Announcement
Because we run licensed LiteSpeed servers, we’re on LiteSpeed’s private security list. On 5 November they quietly warned customers about the flaw and shared the fixed versions, so servers could be updated before the details became public. Once a fix like this is published, attackers can study it and start targeting servers that haven’t been updated.
We acted the same morning:
- Checked every server. We confirmed which of our servers run LiteSpeed and HTTP/3, and so were affected.
- Installed the fixed versions. Our servers were updated to the patched releases, LiteSpeed Enterprise 6.3.7 build 8 and OpenLiteSpeed 1.9.4, within hours of the warning.
- Kept every website online. The update needed only a quick restart of a few seconds per server. No websites were taken offline and there was no planned downtime.
- Tested before and after. We checked our clients’ websites loaded fully before and after the update, and ran our security firewall tests to make sure checkouts, logins and website editors were still working as normal.
- Kept HTTP/3 switched on. Some hosts disable HTTP/3 as a stopgap, which makes websites slower on phones. Because we installed the full fix, our clients keep the faster connection.
LiteSpeed also announced a separate fix for its caching module for PrestaShop online shops. We checked our servers, and none of our clients’ shops were affected.
Why We’re Not Sharing The Technical Details
LiteSpeed is holding back the technical details of the flaw until 16 November, to give hosts around the world time to update first. Once those details are out, attackers can use them against any server that hasn’t been updated. So we’ve kept this post to what you need to know, and left the technical side for LiteSpeed to publish.
That’s how responsible disclosure is meant to work, and it’s why it matters that your host is on the inside of these warnings rather than reading about them in the news.
What This Means For You
If your website is hosted with InfaCloud, there’s nothing you need to do. It was protected the same day the warning came in.
If your website is hosted somewhere else, it’s worth asking your hosting provider three questions:
- Does my website run on LiteSpeed or OpenLiteSpeed?
- Have you installed the November 2026 LiteSpeed security update (LiteSpeed Enterprise 6.3.7 build 8, or OpenLiteSpeed 1.9.4, or later)?
- If not, when will you, and is HTTP/3 switched off until then? The update should be in place before 16 November.
If you don’t get a clear answer, or you’re not sure who looks after your hosting, get in touch and we’ll check your website for you, free of charge.
Security That Works Behind The Scenes
Most of the time, good security means you never hear about it. This is the second critical server flaw in a month, and both times our clients’ websites stayed online and protected without them having to lift a finger. That’s what our web hosting is built around: real people looking after your website and acting fast when it matters.
