Hackers Abuse GitHub Actions to Exploit cPanel and WHM Servers and Steal Cloud Credentials

A widespread campaign has been discovered where attackers plant malicious GitHub Actions workflow files in compromised repositories to spin up ephemeral Ubuntu runners that download a Linux payload, scan the internet for cPanel/WHM targets, attempt exploitation of CVE-2026-41940, and exfiltrate credentials and tokens; analysts observed thousands of matching workflows, multiple compromised Packagist packages from a maintainer account, and provided IoCs and mitigation guidance.