CVE-2026-41940: GitHub Actions, cPanel/WHM — Automated Credential Theft Campaign (July 2026)

CVE-2026-41940 — GitHub Actions, cPanel/WHM

CVE-2026-41940 is a high-severity authentication bypass vulnerability actively exploited in July 2026. Attackers leveraged compromised GitHub Actions runners to automate exploitation of cPanel and WHM servers, enabling large-scale credential and secret theft. The campaign is ongoing and targets internet-facing Linux servers running vulnerable cPanel/WHM instances.

Attack Vector

Attackers compromised the GitHub account of a PHP developer (dinushchathurya) and injected malicious workflows into ten Packagist packages. When triggered on GitHub-hosted runners, these workflows downloaded Linux payloads that scanned for cPanel and WHM servers vulnerable to CVE-2026-41940. Exploitation required no prior access to target servers; the payloads used an authentication bypass to gain remote elevated control, exfiltrating credentials, configuration files, API keys, payment data, and SSH secrets. Infrastructure indicators include traffic to 43.228.157.68 and DNS queries with the unique identifier f5b0b742-240a-4811-8a5b-b0ba6060685d.

Who Is at Risk

Organizations running cPanel or WHM on Linux servers are at immediate risk, especially if exposed to the internet and not patched against CVE-2026-41940. Confirmed affected entities include dinushchathurya, Packagist, and GitHub, but the attack infrastructure enables global reach. Any organization using impacted Packagist packages or hosting vulnerable cPanel/WHM deployments should assume exposure.

Patch & Mitigate

• Patch: Apply the official cPanel/WHM security update for CVE-2026-41940 immediately. If a patch is unavailable, restrict external access to management interfaces.
• Workaround: Disable GitHub Actions workflows on untrusted repositories and audit all third-party package dependencies for unauthorized workflow changes.
• Detect: Monitor server and network logs for outbound connections to 43.228.157.68 and DNS queries containing f5b0b742-240a-4811-8a5b-b0ba6060685d. Review GitHub Actions workflow histories for suspicious modifications.

MITRE ATT&CK

• TA0006 — Credential Access: Attackers harvested credentials and secrets from compromised servers.
• TA0009 — Collection: Exfiltration of configuration files, API keys, and payment data occurred post-compromise.
• TA0007 — Discovery: Automated payloads scanned for vulnerable cPanel/WHM instances across the internet.

Source: https://thehackernews.com/2026/07/attackers-weaponize-github-actions.html