Large-Scale Cyber Campaign Hijacks GitHub Actions to Target Web Hosting Servers
A sophisticated cyber campaign is exploiting GitHub Actions to weaponize trusted open-source projects, turning them into tools for scanning and compromising web hosting servers. The attack, uncovered by analysts at Socket.dev, abuses free GitHub compute resources to target cPanel and WHM servers critical infrastructure for managing websites, email accounts, and databases.
Between July 12 and 13, 2026, attackers compromised a legitimate PHP developer’s Packagist account, injecting malicious GitHub Actions workflow files into ten development versions of their packages. These workflows, containing 55–62 malicious files each, launch temporary Ubuntu runners that download Linux payloads and scan the internet for vulnerable hosts. The campaign extends beyond the initial compromise, with thousands of matching workflow files discovered across unrelated repositories, indicating a broad effort to hijack automation pipelines.
The attack chain begins when a compromised repository triggers a workflow, spinning up an ephemeral GitHub runner. The runner fetches a processor-specific payload from a threat actor-controlled server (43.228.157.68) and exploits CVE-2026-41940, an authentication bypass flaw in cPanel and WHM. Successful breaches expose cloud credentials, payment data, and source control tokens including AWS keys, GitHub/GitLab tokens, OpenAI/Google API keys, Stripe credentials, and SSH material.
The malware exfiltrates stolen data in small chunks via HTTP POST requests, with heartbeats sent every 30 seconds. While installing the affected PHP packages does not directly execute the malware, root-level GitHub Actions in compromised repositories serve as the attack engine. A single WHM compromise can jeopardize multiple customer accounts, databases, and application secrets.
The campaign remains active despite the suspension of one GitHub account, underscoring its persistence. Indicators of compromise include the C2 server IP (43.228.157.68), payload delivery URLs, and the compromised maintainer account (dinushchathurya). Affected Packagist packages span multiple repositories, all tied to the same developer.
Defensive measures include disabling suspicious workflows, rotating credentials, and patching cPanel/WHM systems. The incident highlights the risks of untrusted automation in CI/CD pipelines, echoing past supply chain attacks where stolen credentials enabled further breaches.
Source: https://cybersecuritynews.com/hackers-abuse-github-actions-to-exploit-cpanel/
WHMCS cybersecurity rating report: https://www.rankiteo.com/company/whmcs-ltd
Packagist Conductors cybersecurity rating report: https://www.rankiteo.com/company/packagist
GitHub cybersecurity rating report: https://www.rankiteo.com/company/github
cPanel cybersecurity rating report: https://www.rankiteo.com/company/cpanel
"id": "WHMPACGITCPA1784816835",
"linkid": "whmcs-ltd, packagist, github, cpanel",
"type": "Cyber Attack",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Software Development',
'name': 'dinushchathurya (Packagist account)',
'type': 'Open-source developer'},
{'customers_affected': 'Thousands of repositories '
'potentially affected',
'industry': 'Software Development',
'name': 'GitHub repositories using compromised '
'workflows',
'type': 'Open-source projects'},
{'customers_affected': 'Multiple customer accounts per '
'compromised WHM server',
'industry': 'Web Hosting, IT Services',
'name': 'cPanel and WHM users',
'type': 'Web hosting providers and customers'}],
'attack_vector': 'GitHub Actions workflows, compromised open-source packages',
'data_breach': {'data_exfiltration': 'Yes (via HTTP POST requests in small '
'chunks)',
'personally_identifiable_information': 'Yes (cloud '
'credentials, source '
'control tokens, '
'payment information)',
'sensitivity_of_data': 'High (personally identifiable '
'information, financial data, '
'authentication tokens)',
'type_of_data_compromised': 'Credentials, payment data, API '
'keys, SSH material'},
'date_detected': '2026-07-12',
'description': 'A sophisticated cyber campaign is exploiting GitHub Actions '
'to weaponize trusted open-source projects, turning them into '
'tools for scanning and compromising web hosting servers. The '
'attack abuses free GitHub compute resources to target cPanel '
'and WHM servers, critical infrastructure for managing '
'websites, email accounts, and databases. The malware '
'exfiltrates stolen data in small chunks via HTTP POST '
'requests, with heartbeats sent every 30 seconds. A single WHM '
'compromise can jeopardize multiple customer accounts, '
'databases, and application secrets.',
'impact': {'data_compromised': 'Cloud credentials, payment data, source '
'control tokens (AWS keys, GitHub/GitLab '
'tokens, OpenAI/Google API keys, Stripe '
'credentials, SSH material)',
'identity_theft_risk': 'High (exposure of personally identifiable '
'information and credentials)',
'operational_impact': 'Compromise of multiple customer accounts, '
'databases, and application secrets',
'payment_information_risk': 'High (Stripe credentials and payment '
'data compromised)',
'systems_affected': 'cPanel and WHM servers, web hosting '
'infrastructure'},
'initial_access_broker': {'backdoors_established': 'Malicious GitHub Actions '
'workflows',
'entry_point': 'Compromised Packagist account and '
'GitHub Actions workflows',
'high_value_targets': 'cPanel and WHM servers, '
'cloud credentials, payment '
'data'},
'investigation_status': 'Active',
'lessons_learned': 'Risks of untrusted automation in CI/CD pipelines, '
'importance of credential rotation and patch management',
'motivation': 'Data exfiltration, credential theft, financial gain',
'post_incident_analysis': {'corrective_actions': 'Patch management, '
'credential rotation, '
'disabling untrusted '
'workflows, enhanced '
'monitoring of CI/CD '
'pipelines',
'root_causes': 'Exploitation of GitHub Actions '
'automation, unpatched cPanel/WHM '
'vulnerability (CVE-2026-41940), '
'compromised open-source maintainer '
'account'},
'recommendations': 'Disable suspicious GitHub Actions workflows, rotate '
'exposed credentials, patch cPanel/WHM systems, monitor '
'for unauthorized access',
'references': [{'source': 'Socket.dev'}],
'response': {'containment_measures': 'Disabling suspicious workflows, '
'rotating credentials',
'remediation_measures': 'Patching cPanel/WHM systems '
'(CVE-2026-41940)',
'third_party_assistance': 'Socket.dev (analysts)'},
'title': 'Large-Scale Cyber Campaign Hijacks GitHub Actions to Target Web '
'Hosting Servers',
'type': 'Supply Chain Attack',
'vulnerability_exploited': 'CVE-2026-41940 (authentication bypass flaw in '
'cPanel and WHM)'}