Published on 28 July 2026
Attackers have built a gigantic, free attack network out of GitHub – and are aiming it squarely at cPanel and WHM servers. Using a compromised developer account, they smuggled 583 malicious automation files into ten widely used PHP packages. These files launch automated programs on GitHub's own servers that scan the entire internet for vulnerable web hosting servers and hijack them via the critical vulnerability CVE-2026-41940. Anyone running a website on a cPanel-based server – which in Germany affects a great many SMEs – should act now.
Between 12 and 13 July 2026, unknown attackers took over the GitHub account of the legitimate PHP and DevOps developer "dinushchathurya". Rather than embedding malicious code directly into the software as is usual, they chose an unusual route: they injected a total of 583 malicious GitHub Actions workflow files (these are automation instructions in YAML format that GitHub executes automatically when certain events occur) into ten packages on Packagist – the central registry for PHP libraries from which developers worldwide obtain their building blocks.
The insidious part: the malicious code is not located in the actual PHP program code, but exclusively in the automation files under the .github/workflows/ directory. On 13 July, Packagist automatically synchronised the manipulated development versions (the so-called "dev-main" versions). In one fell swoop, the 583 malicious files were active.
The security research firm Socket discovered the campaign and published its analysis report on 22 July 2026; The Hacker News reported on 23 July. The developer's GitHub account was suspended. Yet the campaign is still considered ongoing – forks, mirrors and other compromised repositories may still be active.
"The PHP libraries were not the execution path. The attackers had inserted dozens of malicious GitHub Actions workflows into the compromised maintainer's source repositories." – Socket (security research company)
The process is clever and shows how legitimate cloud infrastructure is repurposed. The malicious workflows launch on GitHub's own, freely provided Ubuntu servers (so-called "runners"). These runners:
The specific scan command is: /tmp/.svc ipscan --source random,all --exploit CVE-2026-41940 --git --envdump --ports 80,443,8080,8443,2082,2083,2086,2087. The attackers are thus using GitHub as a distributed, free exploit network. A GitHub code search for the campaign's unique identifier returned around 6,100 matching workflow files; broader searches for the C2 address and the exfiltration logic even yielded 15,000 to 16,000 hits.
CVE-2026-41940 is a critical vulnerability with the highest possible rating close to the maximum (CVSS 9.8). It is an authentication bypass – a circumvention of the login – in the HTTP Basic Auth handler of the cPanel daemon cpsrvd. It is based on a so-called CRLF injection (the smuggling of line-break control characters into input fields).
Put simply: the attacker sends a manipulated login header whose contents contain hidden line breaks with key-value pairs smuggled inside them – for example user=root, hasroot=1 and tfa_verified=1. Because a filter function is not called on this code path, the server writes these entries unchecked into a pre-login session file. At the next processing step, the smuggled lines are then interpreted as genuine session attributes.
The result: the attacker is treated as an authenticated root administrator – without a password and with two-factor authentication bypassed, since tfa_verified=1 was set directly as well. This gives the attacker full control over the server.
"Compromising cPanel is fundamentally different from compromising a single customer website. WHM grants root administrator access to the server. An attacker with this access can read every customer hosting account, alter files and databases, create backdoor accounts, install malware, steal credentials and pivot into customer networks." – Hadrian (security company)
On successfully hijacked servers, the attackers search for anything that can be monetised or used for follow-up attacks: AWS keys, GitHub and GitLab tokens, OpenAI and Google API credentials, Stripe, SendGrid and Mailgun keys, database credentials, SSH material and Git remotes.
Affected in principle are all unpatched cPanel and WHM versions prior to the fix for CVE-2026-41940 (according to the vendor, all versions after 11.40), as well as the manipulated dev-main versions of the PHP packages by developer "dinushchathurya".
The scale is considerable: according to Shodan telemetry from Rapid7, around 1.5 million cPanel instances are connected to the internet; Eye Security even identified more than 2 million in April 2026. According to W3Techs, cPanel controls around 94% of the market for web hosting control panels. Especially at risk are:
Germany is by no means on the sidelines here. According to XLab/QiAnXin, more than 2,000 attacker IPs were active worldwide in May 2026 – predominantly from Germany, the USA, Brazil and the Netherlands.
/usr/local/cpanel/cpanel -V. If the version is below the patched versions (e.g. below 11.110.0.97 for the 11.110 branch), the server is potentially vulnerable.ioc_checksessions_files.sh from support.cpanel.net and run it as root. It checks session files in /var/cpanel/sessions/ for indicators of compromise (IOCs).grep -lE "^(hasroot|tfa_verified|successful_internal_auth_with_timestamp)=1" /var/cpanel/sessions/raw/* 2>/dev/null can be used to detect suspicious entries.composer.json and composer.lock files for affected packages (dinushchathurya/*). Dev-main versions in particular are affected..github/workflows/ containing the C2 address 43.228.157.68 or the campaign identifier f5b0b742-240a-4811-8a5b-b0ba6060685d.crontab -l), SSH authorized keys (/root/.ssh/authorized_keys), unknown processes and newly installed packages within the exposure window./scripts/upcp --force, then restart the service with /scripts/restartsrv_cpsrvd --hard. With managed hosting, urge your provider to update immediately. For CentOS 6 / CloudLinux 6 with v110.0.50, v110.0.103 is available.cpsrvd/cpdavd can be stopped.GITHUB_TOKEN permissions to the minimum and set up an approval requirement for external workflows.This vulnerability has a long backstory. According to Daniel Pearson, CEO of KnownHost, CVE-2026-41940 was already being actively exploited as a zero-day (i.e. before any public disclosure) around 23 February 2026 – roughly 64 days before cPanel released the emergency patch on 28 April 2026.
"This has definitely been exploited in the wild, and for at least the last 30 days, if not longer." – Daniel Pearson, CEO of KnownHost
On 30 April 2026, the US agency CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue and set US federal agencies a patching deadline of 3 May. At that point, the Shadowserver Foundation reported around 44,000 IP addresses involved in attacks. The current GitHub Actions campaign proves it: even months after the patch, attackers continue to exploit the flaw on a large scale – simply because many servers are never updated.
For German SMEs, a cPanel/WHM compromise has significant data protection implications. Since a server takeover typically involves customer data, database credentials and email content, a breach of the protection of personal data must be assumed.
Under Art. 33 GDPR, such an incident must be reported without undue delay, and where feasible within 72 hours of becoming aware of it, to the competent supervisory authority (in Germany the state authorities, e.g. BayLDA, LfDI Baden-Württemberg or the Berlin Commissioner for Data Protection), provided there is a risk to the rights and freedoms of natural persons. Where there is a high risk, an additional obligation to notify the affected individuals may apply under Art. 34 GDPR.
Important for SMEs on managed hosting: as a processor under Art. 33(2) GDPR, your hosting provider is obliged to inform you as the controller without undue delay about a data breach. Check whether your data processing agreement (DPA) contains corresponding clauses. Fines for breaches of the notification obligations can amount to up to 10 million euros or 2% of global annual turnover – in 2024 the Irish data protection authority imposed 1.2 million euros solely for a late notification. Across Europe, more than 167,000 data breaches were reported in 2025, an increase of 14% over the previous year.
This campaign combines two serious threats: a critical authentication bypass already exploited as a zero-day in software that dominates 94% of the control panel market – and a supply-chain attack that abuses GitHub's own infrastructure as a free attack network. For German SMEs the risk is high, because a successful takeover means root access to the entire server: all hosted websites, all customer data, all credentials.
The good news: a patch has existed since 28 April 2026. The bad news: it only works if it is applied. So check your cPanel version today, restrict the access ports, run the detection script – and proactively raise the matter with your hosting provider. Anyone developing PHP projects should additionally review their Packagist dependencies and GitHub workflows. In this case, waiting will, if in doubt, cost far more than an update.