GitHub Actions Exploited in Large-Scale cPanel and WHM Server Attacks
In July 2026, a large-scale cyberattack exploited compromised GitHub repositories to target cPanel and WebHost Manager (WHM) servers. Attackers inserted malicious GitHub Actions workflows into repositories associated with a legitimate PHP developer, leading to the deployment of GitHub-hosted runners that scanned for vulnerable cPanel and WHM instances susceptible to CVE-2026-41940, an authentication bypass vulnerability. Upon successful exploitation, the attackers harvested sensitive data, including credentials and configuration files, from the compromised servers. This incident underscores the evolving nature of supply chain attacks, where trusted development tools and platforms are weaponized to facilitate widespread exploitation. Organizations must remain vigilant and implement robust security measures to protect against such sophisticated threats.
Kill Chain
