Supply Chain Attack: GitHub Actions Weaponized Against cPanel Servers

Step by step
How the attack unfolded
Click a phase for details – or let the animation play through.
PHASE 1/7 · Supply Chain Compromise

Attackers hijacked a legitimate developer account and injected malicious code into widely used PHP packages.

T1195.001 – Supply Chain Compromise: Compromise Software Dependencies and Development Tools T1078 – Valid Accounts
  • GitHub account of developer 'dinushchathurya' hijacked between July 12–13, 2026
  • 583 malicious GitHub Actions workflow files injected into 10 Packagist packages
  • Malicious code hidden only in .github/workflows/, not in the PHP code
  • Packagist auto-synced the tampered dev-main versions on July 13
PHASE 2/7 · Execution on GitHub Infrastructure

The tampered workflows executed automatically on GitHub's free runners and downloaded an attack tool.

T1053.005 – Scheduled Task/Job: GitHub Actions (CI/CD Execution) T1059.004 – Command and Scripting Interpreter: Unix Shell T1105 – Ingress Tool Transfer
  • Execution on GitHub's free Ubuntu runners (distributed free exploit network)
  • Detection of processor architecture (x86/ARM, 32/64-bit)
  • Download of a Linux attack binary from C2 server 43.228.157.68
  • Code search yielded ~6,100 to 16,000 matching workflow files
PHASE 3/7 · Reconnaissance and Scanning

The runners scanned the entire internet for vulnerable cPanel and WHM servers.

T1595.002 – Active Scanning: Vulnerability Scanning T1046 – Network Service Discovery
  • Scan command: /tmp/.svc ipscan --source random,all --exploit CVE-2026-41940
  • Target ports: 80,443,8080,8443,2082,2083,2086,2087
  • Search for cPanel/WHM servers vulnerable to CVE-2026-41940
  • ~1.5M cPanel instances exposed to the internet (Rapid7/Shodan)
PHASE 4/7 · Exploitation and Privilege Escalation

Via CVE-2026-41940 the attackers bypassed login and 2FA to gain root access.

T1190 – Exploit Public-Facing Application T1548 – Abuse Elevation Control Mechanism T1556.006 – Modify Authentication Process: Multi-Factor Authentication
  • CVE-2026-41940: authentication bypass in cpsrvd (CVSS 9.8)
  • CRLF injection in the HTTP Basic Auth handler
  • Smuggled values: user=root, hasroot=1, tfa_verified=1
  • Result: authenticated root access without password, 2FA bypassed
PHASE 5/7 · Credential Collection

On compromised servers the attackers harvested all usable credentials and keys.

T1552 – Unsecured Credentials T1552.001 – Credentials In Files T1005 – Data from Local System
  • Harvested: AWS keys, GitHub/GitLab tokens, OpenAI/Google API credentials
  • Stripe, SendGrid, Mailgun keys, database credentials
  • SSH material and Git remotes
  • WHM root grants access to every customer hosting account
PHASE 6/7 · Exfiltration

Stolen data was transmitted to the C2 server every 30 seconds.

T1041 – Exfiltration Over C2 Channel T1567 – Exfiltration Over Web Service
  • Transfer via HTTP POST to C2 server 43.228.157.68
  • Exfiltration every 30 seconds
  • Use of GitHub as a distributed, free exfiltration network
PHASE 7/7 · Impact and Persistence

With root control, attackers installed backdoors and pivoted into customer networks.

T1136 – Create Account T1505.003 – Server Software Component: Web Shell T1090 – Proxy
  • Creation of backdoor accounts and malware installation
  • Related campaign (Mr_Rot13): Filemanager backdoor, ransomware, Telegram exfiltration
  • Pivoting into customer networks; read/modify all files and databases
  • Campaign considered ongoing — forks and mirrors still active
Short & clear answers
Frequently asked questions about this incident
Am I affected by this cPanel attack?
All unpatched cPanel and WHM servers are affected (all versions after 11.40 up to the fixed versions for CVE-2026-41940). Check your version via SSH with /usr/local/cpanel/cpanel -V; if it is below the patched versions (e.g. below 11.110.0.97 in the 11.110 branch), your server is potentially vulnerable. If you use managed hosting, ask your provider whether the server has already been patched.
What do I need to do right now?
Update cPanel/WHM immediately with /scripts/upcp --force and then restart the service with /scripts/restartsrv_cpsrvd. Afterwards, run cPanel's official detection script ioc_checksessions_files.sh from support.cpanel.net as root to identify indicators of compromise. If you use managed hosting, contact your provider right away and confirm the patch status.
How can I tell if my server has already been hacked?
Check session files with the command grep -lE "^(hasroot|tfa_verified|successful_internal_auth_with_timestamp)=1" /var/cpanel/sessions/raw/* for suspicious entries. Also inspect root cron jobs (crontab -l), SSH keys under /root/.ssh/authorized_keys, and any unknown processes or newly installed packages since April 2026. In your own GitHub repositories, search under .github/workflows/ for the C2 address 43.228.157.68 or the identifier f5b0b742-240a-4811-8a5b-b0ba6060685d.
Why is this vulnerability so dangerous?
CVE-2026-41940 carries a critical CVSS score of 9.8 and allows attackers to bypass authentication and two-factor authentication. The attacker is treated as a root administrator without any password and gains full control of the server. This lets them read all hosted customer accounts, modify files and databases, plant backdoors, and steal credentials such as AWS keys, API tokens, SSH material, and database passwords.
I use PHP packages from Packagist – am I at risk?
Only the dev-main versions of ten packages by the developer 'dinushchathurya' are affected. Check your composer.json and composer.lock for dependencies matching dinushchathurya/*. The malicious code is not in the PHP code itself but in malicious GitHub Actions workflow files under .github/workflows/, which run automated scans on GitHub's servers.
More security news
You might also be interested in
Critical Elementor Pro Flaw: Attackers Can Fully Take Over WordPress Sites
A file upload bug in Elementor Pro up to 4.2.1 allows RCE without login. Version 4.2.2 fixes the flaw – update now!
Pods Plugin: Critical Flaw Enables Admin Takeover, No Login
A critical flaw in the WordPress plugin Pods lets attackers overwrite admin passwords without login. Over 100,000 sites are affected.
miniOrange SAML SSO: Critical Bypass Turns Attackers Into Admins
Two critical auth bypasses in the miniOrange SAML SSO plugin allow forged SAML assertions—up to full WordPress admin access.