Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

Back Thehackernews

Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

Thehackernews •[email protected] (The Hacker News) • July 23, 2026

Share: View original

Learn how to secure AI agents with practical controls for access, visibility, secrets, and risk containment.

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitHub Actions Exploited to Attack cPanel and WHM Servers A large-scale cyber campaign has compromised multiple GitHub repositories to deploy malicious workflows targeting cPanel and WHM servers. Attackers are using GitHub Actions to automate the scanning of the internet for vulnerable installations, specifically exploiting the authentication-bypass flaw CVE-2026-41940. The malicious workflows leverage GitHub's compute resources to run scans and potentially steal cloud credentials. This operation has turned trusted open-source projects into tools for widespread attacks, affecting numerous web hosting environments. The campaign has been linked to the discovery of malicious development versions across multiple Packagist PHP packages. As of now, the exploitation of this vulnerability is active, and organizations using cPanel and WHM are at significant risk. 4 sources 70

Extracted Entities

Platforms (2)

Tools (1)

GitHub Actions Runners