GitHub Runners Weaponized Against cPanel Servers

Attackers compromised a PHP developer's GitHub repositories to launch a large-scale campaign targeting cPanel and WHM servers. Malicious GitHub Actions workflows downloaded Linux payloads from attacker-controlled infrastructure to exploit CVE-2026-41940, an authentication bypass vulnerability. The campaign harvested credentials, configuration files, and cloud keys from vulnerable servers.