GitHub Actions Runners Weaponized to Target cPanel/WHM Servers
Attackers are exploiting compromised GitHub repositories and GitHub Actions runners to build distributed attack infrastructure targeting cPanel and WHM servers, leveraging a known authentication bypass vulnerability.
A sophisticated campaign has emerged where threat actors are weaponizing compromised GitHub repositories to create distributed attack infrastructure, specifically targeting cPanel and WebHost Manager (WHM) servers. Researchers have identified that malicious development versions of ten PHP packages, associated with a legitimate developer, were used to facilitate this operation between July 12 and 13, 2026.
The core of the attack does not involve users directly downloading malicious packages. Instead, the threat actors injected dozens of malicious GitHub Actions workflows into the compromised developer's source repositories. These workflows, when triggered, utilize GitHub-hosted runners to download a Linux payload from attacker-controlled infrastructure. This payload then actively scans for vulnerable cPanel and WHM instances.
The primary vulnerability exploited in these attacks is CVE-2026-41940, an authentication bypass flaw that allows remote attackers to gain elevated privileges on the control panel. Once access is achieved, the payload proceeds to exfiltrate a wide array of sensitive data. This includes credentials, configuration files, environment variables, SSH keys, Git tokens, cloud API keys, payment service credentials, and other valuable secrets.
The exact method by which the threat actor initially compromised the developer's GitHub account remains unclear. However, the malicious development versions were automatically synchronized to Packagist, the PHP package repository, reflecting the changes made to the GitHub repositories. Each of the affected development versions contained a significant number of malicious workflow files, totaling 583 across all ten packages.
These YAML automation files are designed to detect the runner's processor architecture and download a compatible Linux payload from a command-and-control server. The workflows then continuously report their execution status and upload collected results, including credentials for cloud services, code repositories, and payment processors, back to the threat actor.
This campaign represents a novel approach, diverging from traditional malicious package attacks by leveraging GitHub Actions runners as the execution environment for scanning and exploitation. This allows attackers to bypass traditional defenses that might focus on package consumers' systems.
Evidence suggests this is part of a broader campaign, with thousands of similar workflow files found on GitHub containing a unique identifier. Researchers describe this as an "opportunistic server-side credential theft operation," where the stolen data can be used for further compromises or direct monetization.
The campaign shares tactical similarities with other observed activities, including those tracked under the moniker Water Curse, which also utilizes GitHub for hosting malware-laced payloads. This model allows threat actors to efficiently turn software discovery platforms into staging grounds for attacks, particularly when targeting users inclined to run untrusted tools.
This new campaign specifically abuses GitHub Actions to host malicious workflow files that scan for and exploit CVE-2026-41940, an authentication bypass flaw in cPanel and WHM servers. The attackers are leveraging free GitHub compute power to steal cloud credentials, payment keys, and source control tokens, posing a broad supply chain risk across numerous repositories.