Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

Attackers have compromised GitHub repositories of a legitimate PHP developer, dinushchathurya, to distribute malicious GitHub Actions workflows. These workflows leverage GitHub-hosted runners to scan for and exploit cPanel and WHM servers vulnerable to CVE-2026-41940, an authentication bypass flaw. The campaign conducts large-scale server-side credential theft, harvesting sensitive data such as cloud keys, API tokens, and SSH credentials, while abusing legitimate development infrastructure for scalability and stealth.

AI-extracted · verify before operational use