Hackers Turn GitHub Actions Into a Global Botnet for Attacking Web Hosting Servers

Gbhackers •Mayura Kathir • July 23, 2026

Hackers are abusing compromised GitHub repositories and GitHub Actions workflows to build a de facto global botnet that scans and exploits web hosting servers, with a primary focus on cPanel and WHM deployments. The campaign first surfaced when malicious development versions were discovered across ten Packagist PHP packages tied to a legitimate PHP and DevOps […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitHub Actions Exploited to Attack cPanel and WHM Servers A large-scale cyber campaign has compromised multiple GitHub repositories to deploy malicious workflows targeting cPanel and WHM servers. Attackers are using GitHub Actions to automate the scanning of the internet for vulnerable installations, specifically exploiting the authentication-bypass flaw CVE-2026-41940. The malicious workflows leverage GitHub's compute resources to run scans and potentially steal cloud credentials. This operation has turned trusted open-source projects into tools for widespread attacks, affecting numerous web hosting environments. The campaign has been linked to the discovery of malicious development versions across multiple Packagist PHP packages. As of now, the exploitation of this vulnerability is active, and organizations using cPanel and WHM are at significant risk. 4 sources 70

Extracted Entities

Hackers Turn GitHub Actions Into a Global Botnet for Attacking Web Hosting Servers

The full story

Extracted Entities

Attack Types (1)

Platforms (4)

Tools (1)