CVE-2024-44000Active Exploitation(litespeedtech / litespeed_cache)

This week in GreyNoise data, rented crawlers probed for credentials and configuration secrets across widely deployed web software. A matched pair of crawlers sharing one client fingerprint probed NGINX UI (CVE-2026-27944) and LiteSpeed Cache (CVE-2024-44000), two CVSS 9.8 flaws that leak credentials, private keys, or session material, from two different hosting providers. Alongside them, an RDP brute force cohort spread across three networks under one transport fingerprint. WordPress core SQL injection CVE-2026-60137 also entered the CISA KEV catalog this week. The rented hosts rotate; the fingerprints persist. Customers get the full weekly brief. Our public At The Edge Clear one-pager 👉https://www.greynoise.io/resources/at-the-edge-clear-072026

NØX Echo Lineage Signal: CVE-2024-44000 Entity: LiteSpeed Cache Lineage: Public vulnerability → Public exploit/PoC → Observed exploitation Relationship: - LiteSpeed Cache → CVE-2024-44000 → Evidence → Operational Risk Current State:

NØØT Security Alerts Classification: Critical CVE: CVE-2024-44000 Product: LiteSpeed Technologies / LiteSpeed Cache Summary: VulnCheck reports real-world exploitation activity affecting LiteSpeed Technologies / LiteSpeed Cache. Evidence: Public PoC/exploit available; Active exploitation reported; Severe impact class; Live exploitation observed by VulnCheck canaries Impact: The vulnerability has a severe impact class such as code execution, authentication bypass, account takeover, or privilege escalation. Action: Prioritize vendor remediation, identify exposed affected systems, and investigate for evidence of exploitation when applicable. Date: 27 Feb 2025 Source: https://vulncheck.com/xdb/aced6e17ee8a #NØØT #CyberSecurity #InfoSec #ThreatIntelligence #CyberThreats #CVE #CyberDefense #LiteSpeed_Cache #CVE_2024_44000 #ActiveExploitation #Exploit