Worm evades GitHub search and steals cPanel credentials
The Register reported that a worm abused GitHub Actions in 42 repositories and exploited CVE-2026-41940, an authentication bypass in cPanel/WHM, to steal server credentials. Its payload files measured 12.9–13.7 MB.
The worm hid its payload in files so large that GitHub code search did not index them. Searches for copied malicious code can therefore miss the artifact carrying the worm, even when it is in a repository. The campaign links that discovery gap to a separate risk: stolen cPanel/WHM credentials can reach the servers those panels administer.
For teams connecting GitHub Actions to cPanel/WHM, repository search alone cannot establish whether the campaign reached their hosting infrastructure. And fixing the authentication bypass does not show whether credentials were already stolen.
CVSS 9.8 CRITICAL: cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows… EPSS 99% (100th percentile).