Hackers Abuse GitHub Actions to Exploit cPanel and WHM Servers and Steal Cloud Credentials

Cybersecuritynews •Tushar Subhra Dutta • July 23, 2026

A large-scale cyber campaign is abusing GitHub Actions to turn trusted open source projects into weapons against web hosting servers. Attackers plant malicious workflow files inside compromised repositories and use free GitHub compute power to scan the public internet for weak targets. The operation focuses on cPanel and WHM servers, which manage websites, email accounts, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitHub Actions Exploited to Attack cPanel and WHM Servers A large-scale cyber campaign has compromised multiple GitHub repositories to deploy malicious workflows targeting cPanel and WHM servers. Attackers are using GitHub Actions to automate the scanning of the internet for vulnerable installations, specifically exploiting the authentication-bypass flaw CVE-2026-41940. The malicious workflows leverage GitHub's compute resources to run scans and potentially steal cloud credentials. This operation has turned trusted open-source projects into tools for widespread attacks, affecting numerous web hosting environments. The campaign has been linked to the discovery of malicious development versions across multiple Packagist PHP packages. As of now, the exploitation of this vulnerability is active, and organizations using cPanel and WHM are at significant risk. 4 sources 70

Extracted Entities

Hackers Abuse GitHub Actions to Exploit cPanel and WHM Servers and Steal Cloud Credentials

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)