Cybersecurity researchers have uncovered a large-scale campaign where attackers have compromised GitHub repositories to create a distributed attack infrastructure targeting cPanel and WebHost Manager (WHM) servers.
The campaign involves malicious development versions of ten Packagist packages associated with a legitimate PHP and DevOps developer, identified as dinushchathurya. These compromised packages were active between July 12 and 13, 2026. The affected packages include:
- dinushchathurya/nationality-list
- dinushchathurya/srilankan-divisional-secretariats
- dinushchathurya/srilankan-gn-divisions
- dinushchathurya/srilankan-local-authorities
- dinushchathurya/srilankan-mobile-number-validator
- dinushchathurya/srilankan-state-hospitals
- dinushchathurya/srilankan-universities
- dinushchathurya/uk-mobile-number-validator
- dinushchathurya/uk-post-code
- dinushchathurya/websmslk
Unlike typical supply chain attacks that rely on users downloading and executing malicious packages, this campaign leverages GitHub Actions workflows added to the compromised repositories. These workflows, when triggered by a repository push or manual initiation, launch GitHub-hosted runners that download a Linux payload from attacker-controlled infrastructure. The payload then scans for vulnerable cPanel and WHM servers susceptible to CVE-2026-41940, an authentication bypass vulnerability that allows remote attackers to gain elevated control over the control panel.
Once a vulnerable server is identified, the payload attempts to exploit the authentication bypass and proceeds to harvest sensitive information, including credentials, configuration files, environment variables, database access details, SSH keys, Git tokens, cloud service keys, and payment service credentials.
The exact method by which the attackers gained unauthorized access to the developer’s account and pushed malicious changes to the repositories remains unclear. However, between July 12 and 13, 2026, Packagist automatically synchronized the malicious development versions across all ten packages, reflecting the changes pushed to the developer’s GitHub repositories.
Each affected development version contains between 55 and 62 malicious GitHub Actions workflow files, totaling 583 files across all ten package versions. These YAML automation files launch GitHub-hosted runners upon a repository push or manual initiation, detect the runner’s processor architecture, and download a compatible Linux scanning and exploitation payload from the command and control (C2) server at 43.228.157[.]68.
The workflows continuously report execution status to the attackers and upload newly collected results through HTTP POST requests. The monitored output files include AWS credentials, GitHub and GitLab tokens, OpenAI and Google API credentials, Stripe keys, SendGrid and Mailgun credentials, database information, SSH data, Git remotes, and results of remote code execution attempts.
Unlike traditional malicious package campaigns that rely on end-users executing the compromised packages, this campaign abuses GitHub Actions to run scanning and exploitation processes on GitHub-hosted runners. This approach allows the attackers to target vulnerable cPanel and WHM servers without direct interaction with the end-users’ systems.
Indicators suggest that this campaign may be part of a broader operation extending beyond a single PHP maintainer. Approximately 6,100 workflow files hosted on GitHub contain a unique DNSHook identifier, indicating a widespread and coordinated effort to exploit GitHub Actions for malicious purposes.
This incident underscores the evolving nature of supply chain attacks, where attackers are increasingly targeting development and deployment infrastructures. Organizations must implement robust security measures, including regular audits of CI/CD pipelines, strict access controls, and continuous monitoring for suspicious activities, to mitigate the risks associated with such sophisticated attacks.
