# Compromised Packagist PHP Packages Weaponize GitHub Actions Runners to Target cPanel/WHM Servers (CVE-2026-41940)

> Threat actors compromised the Packagist account of PHP developer dinushchathurya, publishing malicious development versions of 10 packages that ship weaponized GitHub Actions workflows. The workflows abuse GitHub-hosted runner infrastructure to opportunistically scan the internet for cPanel/WHM servers vulnerable to the CRLF-injection authentication bypass CVE-2026-41940 and harvest AWS, GitHub/GitLab, OpenAI/Google API, Stripe, SendGrid/Mailgun, SSH, and database credentials at scale.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T17:17:09.597Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1681
- **ID:** TL-2026-1681
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-41940

## Description

On July 12-13, 2026, Socket researcher Kirill Boychenko identified that ten legitimate Packagist PHP packages published under the account 'dinushchathurya' (nationality-list, srilankan-divisional-secretariats, srilankan-gn-divisions, srilankan-local-authorities, srilankan-mobile-number-validator, srilankan-state-hospitals, srilankan-universities, uk-mobile-number-validator, uk-post-code, and websmslk) had been pushed malicious development versions after the maintainer's account was compromised. Rather than embedding malware in the PHP library code itself, the attackers planted between 55 and 62 malicious GitHub Actions workflow YAML files per package (583 total), designed to trigger on repository pushes or manual dispatch.

When triggered, each workflow spins up a temporary GitHub-hosted Ubuntu runner, fingerprints the runner's processor architecture (32-bit x86, 64-bit x86, 32-bit ARM, 64-bit ARM), and downloads an architecture-matched Linux payload. The payload turns the free, ephemeral GitHub Actions compute into a distributed, opportunistic internet scanner that hunts for internet-facing cPanel and WebHost Manager (WHM) instances vulnerable to CVE-2026-41940, a critical (CVSSv3.1 9.8) CRLF-injection authentication-bypass flaw disclosed and patched by cPanel on 2026-04-28 after roughly two months of suspected zero-day exploitation beginning around 2026-02-23. The flaw lets an unauthenticated remote attacker inject raw \r\n sequences via a malicious Basic Authorization header into the cpsrvd session-file write path, omitting an expected segment of the whostmgrsession cookie to bypass its encryption and write attacker-controlled properties (e.g. user=root) into a new session file, yielding full administrative access to the panel, its managed databases, and hosted websites.

Each compromised runner reports status and exfiltrates harvested data to a hardcoded C2 server at 43.228.157.68 via HTTP POST, and every malicious workflow embeds a shared DNSHook tracking identifier (f5b0b742-240a-4811-8a5b-b0ba6060685d) used for callback/telemetry correlation. Socket's GitHub code-search for the DNSHook value alone returned roughly 6,100 matching public workflow files; broader searches pivoting on the C2 IP, scanner CLI arguments, and exfiltration endpoint strings returned 15,000-16,000 matching files, indicating this technique of abusing GitHub Actions minutes as free distributed scanning/attack infrastructure is deployed far beyond the ten confirmed Packagist packages. Beyond cPanel/WHM exploitation, the harvested-data set included AWS credentials, GitHub and GitLab access tokens, OpenAI and Google API keys, Stripe keys, SendGrid and Mailgun credentials, database connection information, SSH key material, git remote URLs, and remote-code-execution output — consistent with a client-side opportunistic credential-theft operation whose proceeds enable follow-on breaches, cloud-resource abuse, or resale. Socket noted overlapping tactics (DNSHook-style tracking, credential-harvesting-as-a-service tooling) with the 'Water Curse' cluster tracked by Trend Micro, associated with the email address ischhfd83@rambler.ru, though attribution is not confirmed.

Separately, CVE-2026-41940 itself was independently and heavily exploited in the wild against the broader population of an estimated 1.5 million internet-exposed cPanel/WHM instances (Shodan), with hosting provider KnownHost and multiple vendors (Rapid7, Cato Networks, eSentire, watchTowr, Hadrian) confirming mass exploitation; CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-04-30.

## MITRE ATT&CK

- T1586 Compromise Accounts
- T1195 Supply Chain Compromise
- T1583 Acquire Infrastructure
- T1199 Trusted Relationship
- T1190 Exploit Public-Facing Application
- T1020 Automated Exfiltration
- T1569 System Services
- T1059 Command and Scripting Interpreter
- T1550 Use Alternate Authentication Material
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1110 Brute Force
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1530 Data from Cloud Storage
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1531 Account Access Removal
- T1595 Active Scanning
- T1078 Valid Accounts
- T1584 Compromise Infrastructure
- T1133 External Remote Services
- T1074 Data Staged
- T1496 Resource Hijacking

## Sources

- [Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers](https://thehackernews.com/2026/07/attackers-weaponize-github-actions.html)
- [CVE-2026-41940: cPanel & WHM Authentication Bypass](https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass/)
- [CVE-2026-41940 – cPanel & WHM Authentication Bypass Vulnerability](https://www.esentire.com/security-advisories/cve-2026-41940-cpanel-whm-authentication-bypass-vulnerability)
- [Threat Brief: CVE-2026-41940: Critical cPanel & WHM Authentication Bypass Actively Exploited in the Wild](https://www.catonetworks.com/blog/threat-brief-cve-2026-41940-critical-cpanel-whm-authentication-bypass-actively-exploited-in-the-wild/)
- [CVE-2026-41940 Explained: The cPanel & WHM Authentication Bypass That Hit 1.5M Servers](https://www.picussecurity.com/resource/blog/cve-2026-41940-explained-cpanel-whm-authentication-bypass-hit-1-5m-servers)
- [CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/04/30/cisa-adds-one-known-exploited-vulnerability-catalog)
- [Known Exploited Vulnerabilities Catalog — CVE-2026-41940](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940)
- [CVE Record: CVE-2026-41940](https://www.cve.org/CVERecord?id=CVE-2026-41940)
- [CVE-2026-41940 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-41940)
- [Hackers Abuse GitHub Actions to Exploit cPanel and WHM Servers and Steal Cloud Credentials](https://cybersecuritynews.com/hackers-abuse-github-actions-to-exploit-cpanel/)
- [GitHub Actions Abuse Powers a Distributed cPanel and WHM Attack Campaign](https://securityonline.info/github-actions-abuse-cpanel-whm-exploitation/)
- [GitHub Actions abuse turned Packagist repositories into scanners](https://www.developer-tech.com/news/github-actions-abuse-packagist-repositories-into-scanners/)
- [GitHub Actions Abuse Exploits cPanel CVE-2026-41940 to Steal Server Credentials](https://cyberpress.org/github-actions-cpanel-credential-theft/)
- [Attacks on CPanel and WHM Servers via GitHub Actions Runners](https://www.secnews.gr/en/723348/github-actions-cpanel-whm-servers-epithesi/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1681