Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
Summary: A large-scale campaign turned compromised GitHub repositories into distributed attack infrastructure, with malicious Packagist development versions across 10 packages tied to developer dinushchathurya appearing between July 12 and 13, 2026. Socket said attackers added dozens of malicious GitHub Actions workflows that launch hosted runners, download a Linux payload from 43.228.157[.]68, and scan for cPanel and WHM servers vulnerable to CVE-2026-41940, an authentication bypass allowing elevated control of the panel.
Bottom line: The payload harvests credentials, configuration files, environment variables, database access, SSH material, Git tokens, cloud keys, and payment service credentials, and roughly 6,100 workflow files on GitHub carry the campaign's unique DNSHook identifier, indicating it extends well beyond one maintainer.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Mentions
- CVE-2026-41940
- Related
- CVE-2026-41940: Web Pros cPanel & WHM and WP2 (Word Press Squared) Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Apr 30, 2026