Vulnerabilities · 53 days ago
Compromised developer repos are now part of the attack surface. The campaign is using GitHub-hosted runners as disposable infrastructure, so the scans look like normal CI jobs instead of direct attacker traffic, which makes both attribution and perimeter filtering weaker.
Investigators tied the activity to 583 malicious workflows across 10 compromised Packagist packages tied to a legitimate developer. Those workflows trigger on repo pushes or manual runs, launch GitHub-hosted runners, and target cPanel and WHM instances vulnerable to CVE-2026-41940; cPanel/WHM 11.40 fixes the flaw.
The broader risk is that abused CI can scale exploitation without a stable attack host, and the compromised packages create a second supply-chain path beyond the control panel itself. Once trusted automation is repurposed this way, detection has to account for legitimate cloud infrastructure doing hostile work.
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows… EPSS 99% (100th percentile).
CISA federal remediation date May 3 · date passed
2 sources covering this story
Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
Attackers abuse compromised GitHub repos and hosted runners to target cPanel and WHM via CVE-2026-41940, using 583 workflows across 10 versions.
Large-Scale GitHub Actions Abuse Powers a Distributed cPanel...
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.
Part of the PlainSec briefing for 2026-07-24