GitHub Actions abuse is powering a large-scale attack campaign that exploits the cPanel CVE-2026-41940 authentication bypass to steal server credentials and other sensitive secrets from internet-facing hosting environments.
The operation turns compromised GitHub repositories and their Actions runners into distributed scanning and exploitation infrastructure. At the same time, Packagist PHP packages act mainly as a propagation channel, not the malware execution layer.
The campaign begins with the compromise of a legitimate PHP and DevOps developer’s GitHub account, where the attacker injects dozens of malicious GitHub Actions workflows into multiple repositories tied to ten Packagist packages.
These are development versions that Packagist automatically synchronizes, causing the malicious workflows to propagate across the PHP ecosystem without changing the underlying, benign library code.
Instead of running on developer machines or package consumers’ systems, the workflows execute on GitHub-hosted Ubuntu runners whenever a push occurs, or a workflow is manually triggered, giving the attacker ephemeral but powerful compute for scanning and exploitation at scale.
dinushchathurya, showing the ten PHP packages whose development versions synchronized malicious changes from the maintainer’s compromised GitHub repositories (Source: socket)GitHub Actions cPanel Credential Theft
Between July 12 and 13, 2026, Packagist synchronized malicious development versions across all ten packages, each containing roughly 55–62 workflow files, for a total of 583 malicious workflows.
These YAML files instruct GitHub Actions to spin up runners, detect their CPU architecture, and pull down a Linux payload from a hardcoded command-and-control (C2) server.
This architecture allows the attacker to update or swap payloads centrally while reusing the same workflows to drive scanning and exploitation operations.
The malicious workflows are configured with broad triggers to maximize execution opportunities, they run on pushes to any branch and can be manually invoked via workflow_dispatch.
Each job launches an ubuntu-latest runner, sets a long timeout, and then selects the appropriate payload binary for the runner’s architecture by calling the C2 server over HTTP.
After downloading and marking the payload executable, the workflow runs it with ipscan-like arguments designed for wide internet scanning, vulnerability exploitation, and credential discovery on exposed hosts.
The payload’s command-line parameters target cPanel and WHM services and explicitly attempt exploitation of CVE-2026-41940. This authentication bypass allows attackers to access administrative interfaces without valid credentials.
Once exploitation succeeds, the payload systematically searches compromised systems for high-value data, environment variables, configuration files, cloud service keys, database connection information, SSH keys, Git remotes and tokens, payment processor credentials, and other secrets commonly stored on hosting servers.
This design transforms GitHub Actions from a CI/CD automation tool into a distributed attack framework, socket said.
Indicators of Compromise
| Category | Indicator |
|---|---|
| Compromised maintainer | Packagist username: dinushchathurya |
| Compromised maintainer | Packagist profile: https://packagist.org/users/dinushchathurya/ |
| Compromised maintainer | GitHub username: dinushchathurya |
| Compromised maintainer | GitHub profile: https://github.com/dinushchathurya/ |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
