Compromised Packagist PHP Packages Weaponize GitHub Actions Runners to Target cPanel/WHM Servers (CVE-2026-41940)

Compromised Packagist PHP Packages Weaponize GitHub Actions (TL-2026-1681), also tracked as GitHub Actions cPanel Credential Harvesting Campaign, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-07-25. It has no confirmed attribution, affects Packagist / Composer dinushchathurya PHP packages, references 1 CVE (CVE-2026-41940), maps to 30 MITRE ATT&CK techniques (T1005, T1020, T1036), and is covered by 9 detection rules and 37 indicators of compromise.

Key facts for TL-2026-1681

Threat ID
TL-2026-1681
Also known as
GitHub Actions cPanel Credential Harvesting Campaign, DNSHook Campaign
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-07-25
Last reviewed
2026-07-25
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
hostingproviders, webhosting, managedserviceproviders, softwaredevelopment, cloudinfrastructure, smallbusiness
Target regions
Global
Detection rules
9
Indicators of compromise
37
Updates
2026-07-25 · revalidated 1× · latest source

Malware and tooling in Compromised Packagist PHP Packages Weaponize GitHub Actions

Malware and tooling: water-curse

Threat actors compromised the Packagist account of PHP developer dinushchathurya, publishing malicious development versions of 10 packages that ship weaponized GitHub Actions workflows. The workflows abuse GitHub-hosted runner infrastructure to opportunistically scan the internet for cPanel/WHM servers vulnerable to the CRLF-injection authentication bypass CVE-2026-41940 and harvest AWS, GitHub/GitLab, OpenAI/Google API, Stripe, SendGrid/Mailgun, SSH, and database credentials at scale.

How Compromised Packagist PHP Packages Weaponize GitHub Actions works

On July 12-13, 2026, Socket researcher Kirill Boychenko identified that ten legitimate Packagist PHP packages published under the account 'dinushchathurya' (nationality-list, srilankan-divisional-secretariats, srilankan-gn-divisions, srilankan-local-authorities, srilankan-mobile-number-validator, srilankan-state-hospitals, srilankan-universities, uk-mobile-number-validator, uk-post-code, and websmslk) had been pushed malicious development versions after the maintainer's account was compromised. Rather than embedding malware in the PHP library code itself, the attackers planted between 55 and 62 malicious GitHub Actions workflow YAML files per package (583 total), designed to trigger on repository pushes or manual dispatch.

When triggered, each workflow spins up a temporary GitHub-hosted Ubuntu runner, fingerprints the runner's processor architecture (32-bit x86, 64-bit x86, 32-bit ARM, 64-bit ARM), and downloads an architecture-matched Linux payload. The payload turns the free, ephemeral GitHub Actions compute into a distributed, opportunistic internet scanner that hunts for internet-facing cPanel and WebHost Manager (WHM) instances vulnerable to CVE-2026-41940, a critical (CVSSv3.1 9.8) CRLF-injection authentication-bypass flaw disclosed and patched by cPanel on 2026-04-28 after roughly two months of suspected zero-day exploitation beginning around 2026-02-23. The flaw lets an unauthenticated remote attacker inject raw \r sequences via a malicious Basic Authorization header into the cpsrvd session-file write path, omitting an expected segment of the whostmgrsession cookie to bypass its encryption and write attacker-controlled properties (e.g. user=root) into a new session file, yielding full administrative access to the panel, its managed databases, and hosted websites.

Each compromised runner reports status and exfiltrates harvested data to a hardcoded C2 server at 43.228.157.68 via HTTP POST, and every malicious workflow embeds a shared DNSHook tracking identifier (f5b0b742-240a-4811-8a5b-b0ba6060685d) used for callback/telemetry correlation. Socket's GitHub code-search for the DNSHook value alone returned roughly 6,100 matching public workflow files; broader searches pivoting on the C2 IP, scanner CLI arguments, and exfiltration endpoint strings returned 15,000-16,000 matching files, indicating this technique of abusing GitHub Actions minutes as free distributed scanning/attack infrastructure is deployed far beyond the ten confirmed Packagist packages. Beyond cPanel/WHM exploitation, the harvested-data set included AWS credentials, GitHub and GitLab access tokens, OpenAI and Google API keys, Stripe keys, SendGrid and Mailgun credentials, database connection information, SSH key material, git remote URLs, and remote-code-execution output — consistent with a client-side opportunistic credential-theft operation whose proceeds enable follow-on breaches, cloud-resource abuse, or resale. Socket noted overlapping tactics (DNSHook-style tracking, credential-harvesting-as-a-service tooling) with the 'Water Curse' cluster tracked by Trend Micro, associated with the email address ischhfd83@rambler.ru, though attribution is not confirmed.

Separately, CVE-2026-41940 itself was independently and heavily exploited in the wild against the broader population of an estimated 1.5 million internet-exposed cPanel/WHM instances (Shodan), with hosting provider KnownHost and multiple vendors (Rapid7, Cato Networks, eSentire, watchTowr, Hadrian) confirming mass exploitation; CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-04-30.

MITRE ATT&CK techniques used in TL-2026-1681

Collection

T1005 Data from Local System; T1074 Data Staged; T1119 Automated Collection; T1530 Data from Cloud Storage

exfiltration

T1020 Automated Exfiltration

Defense Evasion

T1036 Masquerading

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter; T1569 System Services

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Privilege Escalation

T1078 Valid Accounts

Credential Access

T1110 Brute Force; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

initial-access

T1195 Supply Chain Compromise

Impact

T1496 Resource Hijacking; T1531 Account Access Removal

lateral-movement

T1550 Use Alternate Authentication Material

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1586 Compromise Accounts

Reconnaissance

T1595 Active Scanning

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Compromised Packagist PHP Packages Weaponize GitHub Actions

  • Packagist / Composer — dinushchathurya PHP packages
    Vulnerable versions: nationality-list (dev versions, published 2026-07-12/13); srilankan-divisional-secretariats (dev versions); srilankan-gn-divisions (dev versions); srilankan-local-authorities (dev versions); srilankan-mobile-number-validator (dev versions); srilankan-state-hospitals (dev versions); srilankan-universities (dev versions); uk-mobile-number-validator (dev versions); uk-post-code (dev versions); websmslk (dev versions)
    Fixed in: Remove malicious dev versions; use vetted tagged releases
  • WebPros / cPanel L.L.C. — cPanel & WHM
    Vulnerable versions: All versions after 11.40 prior to patched builds
    Fixed in: 11.86.0.41; 11.110.0.97; 11.118.0.63; 11.126.0.54; 11.130.0.19; 11.132.0.29; 11.134.0.20; 11.136.0.5
  • WebPros / cPanel L.L.C. — WP Squared (WP2)
    Vulnerable versions: All versions prior to 136.1.7
    Fixed in: 136.1.7

Remediation for Compromised Packagist PHP Packages Weaponize GitHub Actions

Patches

  • cPanel & WHM 11.86.0.41
  • cPanel & WHM 11.110.0.97
  • cPanel & WHM 11.118.0.63
  • cPanel & WHM 11.126.0.54
  • cPanel & WHM 11.130.0.19
  • cPanel & WHM 11.132.0.29
  • cPanel & WHM 11.134.0.20
  • cPanel & WHM 11.136.0.5
  • WP Squared 136.1.7

Immediate actions

  • Remove/downgrade the 10 compromised Packagist packages published under account 'dinushchathurya' to known-clean released versions; pin composer.lock to vetted tags, not dev branches
  • Audit all GitHub repositories/organizations for workflow YAML files containing the DNSHook identifier f5b0b742-240a-4811-8a5b-b0ba6060685d or outbound calls to 43.228.157.68
  • Disable/revoke GitHub Actions workflows triggered unexpectedly on push or workflow_dispatch in dependent repos; review Actions run history for anomalous ephemeral-runner activity
  • Patch cPanel & WHM and WP Squared to the fixed builds immediately (emergency change) on any internet-facing panel
  • Rotate all credentials that may have transited an affected CI runner: AWS keys, GitHub/GitLab tokens, OpenAI/Google API keys, Stripe keys, SendGrid/Mailgun credentials, database credentials, SSH keys

Workarounds

  • Restrict WHM/cPanel administrative interfaces (ports 2087/2086) to trusted management networks via firewall/ACL if immediate patching is not possible
  • Block outbound/inbound traffic to C2 IP 43.228.157.68 at perimeter and CI egress firewalls

Longer-term hardening

  • Require pinned, hash-verified Composer dependencies and disallow installation of -dev/branch-alias versions in production/CI pipelines
  • Restrict GitHub Actions to required workflows only via branch protection + required workflow allow-listing; disable auto-run of workflows from forks/unverified pushes
  • Deploy egress filtering/monitoring on CI runners to detect anomalous outbound HTTP POST to unknown IPs
  • Implement software composition analysis (SCA) / supply-chain scanning (e.g. Socket, Snyk) on all PHP dependencies
  • Adopt WAF/reverse-proxy virtual patching for cPanel/WHM login endpoints and restrict WHM port 2087/2086 access to trusted IP allow-lists

CVEs associated with Compromised Packagist PHP Packages Weaponize GitHub Actions

CVE-2026-41940

Weaknesses (CWE) in Compromised Packagist PHP Packages Weaponize GitHub Actions

CWE-93, CWE-287, CWE-306

Timeline of Compromised Packagist PHP Packages Weaponize GitHub Actions

  • Hosting provider KnownHost observes suspected zero-day exploitation of the cPanel/WHM authentication-bypass flaw later assigned CVE-2026-41940.
  • cPanel issues an emergency security update fixing the CRLF-injection authentication-bypass flaw in cPanel & WHM and WP Squared across all supported branches after 11.40.
  • CVE-2026-41940 is formally assigned; researcher watchTowr publishes a proof-of-concept and technical writeup of the CRLF/session-file exploitation chain.
  • Rapid7 publishes vulnerability-check tooling for CVE-2026-41940 for defenders to assess exposure.
  • CISA adds CVE-2026-41940 to the Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation and mandating remediation.
  • Shadowserver Foundation documents roughly 44,000 unique IPs scanning/exploiting CVE-2026-41940 against an estimated 650,000 exposed cPanel instances.
  • Attackers begin publishing malicious development versions to 10 Packagist packages under the compromised 'dinushchathurya' developer account, embedding 55-62 malicious GitHub Actions workflow files per package.
  • Malicious package publication window closes; Socket researcher Kirill Boychenko begins analysis after detecting the anomalous workflow files.
  • Socket researcher Kirill Boychenko publishes the initial technical analysis of the campaign (C2 infrastructure, payload hash, code-search scale findings), one day ahead of the wider media pickup already on record.
  • Socket's code-search pivots on the DNSHook identifier (~6,100 files) and on C2/scanner/exfiltration strings (~15,000-16,000 files) reveal the technique is used far more broadly than the 10 confirmed compromised packages.
  • The Hacker News and Socket publish coordinated public disclosure of the GitHub Actions abuse campaign, the DNSHook identifier, C2 infrastructure at 43.228.157.68, and the campaign's exploitation of CVE-2026-41940.
  • TL-Intel-Harness ingests the campaign for threat-intel documentation and detection-engineering coverage.

Update history for TL-2026-1681

Sources cited for Compromised Packagist PHP Packages Weaponize GitHub Actions

Threats related to Compromised Packagist PHP Packages Weaponize GitHub Actions

Detection coverage for TL-2026-1681

As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1681 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1681

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats