Hostinger declared a security incident on November 9, 2026, after an attacker exploited a zero-day vulnerability in LiteSpeed Web Server to access approximately 400 accounts on a shared hosting server in Phoenix, United States.
What it means for affected Hostinger accounts
Hostinger reported that an attacker ran code or read credentials, including database credentials and access tokens, on about 400 accounts hosted on one of its more than 5,000 servers.
The hosting provider stated that the attacker initially gained access to a customer website on November 5 through a vulnerable content management system before taking three days to discover and exploit the LiteSpeed Web Server flaw.
Technical details of the breach
According to Hostinger, the previously unknown vulnerability in LiteSpeed Web Server allowed code from one compromised site to bypass the account isolation features provided by CloudLinux CageFS.
This isolation bypass eventually enabled the attacker to achieve root-level access on the server. Hostinger confirmed there is no evidence that internal management systems, login infrastructure, or backup systems were compromised.
Hostinger response and mitigation
Hostinger declared the incident at 12:26 UTC on November 9 after monitoring systems flagged suspicious activity on November 8. Starting at 13:30 UTC, Hostinger migrated all accounts to separate servers and restored affected sites using backups created before the breach.
The affected Phoenix server remains offline for forensic analysis. Hostinger said it notified competent authorities and affected customers while working directly with LiteSpeed to develop a permanent fix.
What to do
- Contact Hostinger Customer Success through the dashboard 24/7 with questions or report security concerns to security@hostinger.com.
Key facts and where they come from
- An attacker exploited a zero-day flaw in LiteSpeed Web Server to access roughly 400 hosting accounts.
The attacker exploited a previously unknown (zero-day) vulnerability in one of our vendors, LiteSpeed Web Server.
- The breach began on November 5 via a vulnerable content management system on a hosted website.
an attacker had first entered on November 5 through a vulnerable content management system on a customer website.
- The zero-day vulnerability bypassed CloudLinux CageFS isolation to provide root-level access on the server.
It allowed code from one website to bypass the isolation between accounts provided by CloudLinux CageFS, eventually leading to root-level access on the server.
- Hostinger restored affected customer websites from backups taken prior to the attack.
moved every account and website to other servers, restored affected websites from backups taken before the attack, and closed each path the attacker used.
