GitHub Actions Turned into cPanel Attack Infrastructure
Compromised developer repos are now part of the attack surface. The campaign is using GitHub-hosted runners as disposable infrastructure, so the scans look like normal CI jobs instead of direct attacker traffic, which makes both attribution and perimeter filtering weaker.
Investigators tied the activity to 583 malicious workflows across 10 compromised Packagist packages tied to a legitimate developer. Those workflows trigger on repo pushes or manual runs, launch GitHub-hosted runners, and target cPanel and WHM instances vulnerable to CVE-2026-41940; cPanel/WHM 11.40 fixes the flaw.
The broader risk is that abused CI can scale exploitation without a stable attack host, and the compromised packages create a second supply-chain path beyond the control panel itself. Once trusted automation is repurposed this way, detection has to account for legitimate cloud infrastructure doing hostile work.