Back Feeds.4Sysops

Compromised GitHub repositories weaponized to attack cPanel and WHM servers

Feeds.4Sysops •IT News • July 23, 2026

Attackers have compromised numerous GitHub repositories to deploy malicious GitHub Actions workflows that function as a distributed attack platform. These automated workflows trigger GitHub-hosted runners to download Linux payloads from a centralized command-and-control server. The primary objective of this infrastructure is to scan the internet for cPanel and WHM installations vulnerable to the authentication-bypass flaw CVE-2026-41940. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitHub Actions Exploited to Attack cPanel and WHM Servers A large-scale cyber campaign has compromised multiple GitHub repositories to deploy malicious workflows targeting cPanel and WHM servers. Attackers are using GitHub Actions to automate the scanning of the internet for vulnerable installations, specifically exploiting the authentication-bypass flaw CVE-2026-41940. The malicious workflows leverage GitHub's compute resources to run scans and potentially steal cloud credentials. This operation has turned trusted open-source projects into tools for widespread attacks, affecting numerous web hosting environments. The campaign has been linked to the discovery of malicious development versions across multiple Packagist PHP packages. As of now, the exploitation of this vulnerability is active, and organizations using cPanel and WHM are at significant risk. 4 sources 70

Extracted Entities

Compromised GitHub repositories weaponized to attack cPanel and WHM servers

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (2)

Platforms (4)