importantSYS.SOURCE: The Hacker News• 2026-07-23T16:58:54+05:30

Exploitation of GitHub Actions Runners for cPanel/WHM Server Attacks via Compromised Repositories

#github #vulnerability #credential-theft #malware #software-supply-chain

Attackers exploited compromised GitHub repositories to deploy malicious workflows that leverage GitHub Actions runners for scanning and exploiting cPanel/WHM servers via CVE-2026-41940, stealing credentials and sensitive data. The campaign uses distributed infrastructure through GitHub-hosted runners to bypass traditional package-based attack vectors.

Cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack infrastructure designed to target cPanel and WebHost Manager (WHM) instances.

The activity involves malicious Packagist development versions spanning 10 packages associated with a legitimate PHP and DevOps developer, dinushchathurya, between July 12 and 13,

Read original article

*** END OF TRANSMISSION ***

> THE AI ECONOMY: INSIGHTS FROM THE FIRST ATLAS REPORT > SYNTHETIC IDENTITY FRAUD TARGETING MACHINE IDENTITIES IN ENTERPRISE ENVIRONMENTS > EXPLOITATION OF GITHUB ACTIONS RUNNERS FOR CPANEL/WHM SERVER ATTACKS VIA COMPROMISED REPOSITORIES > AMD RYZEN AI MAX+ PRO 495 DESKTOP WITH 192GB MEMORY LAUNCHES FROM FRAMEWORK > CORPORATE GREED AND PRODUCT QUALITY DEGRADATION: A BRAND ANALYSIS > KIMI K3'S ADVANCED CAPABILITIES ATTRIBUTED TO INTERNAL DEVELOPMENT, NOT ANTHROPIC'S FABLE DISTILLATION > EU IMPOSES €890M FINE ON GOOGLE FOR ANTI-COMPETITIVE PRACTICES IN SEARCH AND APP STORES > GOOGLE INTRODUCES SELFIE VIDEO AUTHENTICATION FOR ACCOUNT RECOVERY > NINE-YEAR-OLD XFS REFLINK VULNERABILITY ALLOWS LOCAL PRIVILEGE ESCALATION IN RHEL > CHECK POINT ADDRESSES CRITICAL SMARTCONSOLE AUTHENTICATION BYPASS VULNERABILITY CVE-2026-16232> THE AI ECONOMY: INSIGHTS FROM THE FIRST ATLAS REPORT > SYNTHETIC IDENTITY FRAUD TARGETING MACHINE IDENTITIES IN ENTERPRISE ENVIRONMENTS > EXPLOITATION OF GITHUB ACTIONS RUNNERS FOR CPANEL/WHM SERVER ATTACKS VIA COMPROMISED REPOSITORIES > AMD RYZEN AI MAX+ PRO 495 DESKTOP WITH 192GB MEMORY LAUNCHES FROM FRAMEWORK > CORPORATE GREED AND PRODUCT QUALITY DEGRADATION: A BRAND ANALYSIS > KIMI K3'S ADVANCED CAPABILITIES ATTRIBUTED TO INTERNAL DEVELOPMENT, NOT ANTHROPIC'S FABLE DISTILLATION > EU IMPOSES €890M FINE ON GOOGLE FOR ANTI-COMPETITIVE PRACTICES IN SEARCH AND APP STORES > GOOGLE INTRODUCES SELFIE VIDEO AUTHENTICATION FOR ACCOUNT RECOVERY > NINE-YEAR-OLD XFS REFLINK VULNERABILITY ALLOWS LOCAL PRIVILEGE ESCALATION IN RHEL > CHECK POINT ADDRESSES CRITICAL SMARTCONSOLE AUTHENTICATION BYPASS VULNERABILITY CVE-2026-16232