Skip to content

GitHub Actions cPanel CVE-2026-41940 exploitation campaign

Summary

On 2026-07-22, Socket reported a large campaign that turned compromised GitHub repositories and GitHub-hosted Actions runners into distributed infrastructure for scanning and exploiting internet-facing cPanel & WHM systems through CVE-2026-41940. The investigation began with ten Packagist packages associated with the compromised developer identity dinushchathurya, but Socket found that the PHP library code was benign and was not the execution path. The attacker had placed dozens of malicious workflow files under each source repository's root .github/workflows/ directory.

Pushes to any branch or manual dispatch launched ephemeral Ubuntu runners, downloaded an architecture-specific Linux scanner from 43[.]228[.]157[.]68, attempted CVE-2026-41940 exploitation, and returned heartbeat and credential-harvest results to the same server. Socket found roughly 6,100 workflow-file matches for a distinctive DNSHook callback and roughly 15,000–16,000 matches using broader code pivots. Those are file counts—not confirmed compromised repositories, accounts, or victims—but the identical code across unrelated repositories supports a campaign substantially broader than the initial maintainer.

Tags

Why this matters

  • This was not ordinary package install-time malware. Packagist synchronized malicious development versions because their source repositories had been changed, but installing the packages under a consumer project's vendor/ directory did not cause GitHub to execute nested workflows.
  • The executable boundary was the compromised repository root: a push or manual run caused GitHub to provide disposable compute and network access for internet scanning, exploitation, collection, and exfiltration.
  • cPanel and WHM are high-value hosting control planes. A single successful WHM compromise may expose multiple customer environments, while cPanel access can expose website files, databases, mailboxes, application configuration, and server-side secrets.
  • The scanner explicitly sought AWS credentials, GitHub and GitLab tokens, OpenAI and Google credentials, Stripe keys, email-service credentials, databases, SSH material, Git remotes, and environment/configuration files. Stolen source-control credentials create a plausible feedback loop into additional repository compromise.
  • Suspension of the initially identified GitHub account removed one launch path but did not establish campaign containment; other repositories, forks, credentials, compromised servers, and attacker infrastructure may remain usable.

Attack chain

  1. Repository compromise: the attacker gained control of source repositories and committed 55–62 malicious workflow files per affected development version. Socket counted 583 such files across the ten initially analyzed Packagist versions.
  2. Automatic package synchronization: Packagist reflected the branch changes as malicious development versions between 2026-07-12 and 2026-07-13. The affected PHP code itself remained benign.
  3. Runner provisioning: workflows triggered on pushes to any branch or through workflow_dispatch, requesting ubuntu-latest with a 350-minute timeout.
  4. Payload delivery: each runner detected its architecture and retrieved /api/dl/386, /api/dl/amd64, /api/dl/arm, or /api/dl/arm64 from 43[.]228[.]157[.]68, wrote the payload to /tmp/.svc, made it executable, and launched it.
  5. Scanning and exploitation: the payload used random/all source scanning against ports 80, 443, 8080, 8443, 2082, 2083, 2086, and 2087, attempted CVE-2026-41940, and enabled Git and environment discovery.
  6. Telemetry and exfiltration: a background loop posted repository identity and scanner status to /api/github-heartbeat every 30 seconds. Incremental and final collection loops sent newly written results to /api/github-results, including the repository and GitHub run ID.
  7. Blind execution confirmation: at least 14 recovered workflows queried a campaign-specific dnshook[.]site hostname, giving the operator an out-of-band execution signal.

Scope and confidence

Socket's public code-search figures must not be converted directly into victim counts:

  • one repository can contain many duplicated workflows;
  • GitHub can group identical results;
  • some repositories may be attacker-controlled staging rather than compromised victims; and
  • matching code does not prove a successful workflow run or successful downstream exploitation.

The strong conclusion is that identical, distinctive workflow logic appeared across unrelated repositories and that some public repositories had Actions runs. The public evidence does not identify an actor, quantify successfully exploited cPanel/WHM hosts, or prove every matching repository was compromised.

Affected Packagist development packages

The following package identifiers are victim-linked pivots, not actor attribution:

dinushchathurya/nationality-list
dinushchathurya/srilankan-divisional-secretariats
dinushchathurya/srilankan-gn-divisions
dinushchathurya/srilankan-local-authorities
dinushchathurya/srilankan-mobile-number-validator
dinushchathurya/srilankan-state-hospitals
dinushchathurya/srilankan-universities
dinushchathurya/uk-mobile-number-validator
dinushchathurya/uk-post-code
dinushchathurya/websmslk

Avoid unreviewed development versions and validate lockfile commit references. Ordinary installation of these versions does not by itself establish workflow execution or host compromise.

Public indicators

Network and workflow pivots

43[.]228[.]157[.]68
hxxp://43[.]228[.]157[.]68/api/dl/386
hxxp://43[.]228[.]157[.]68/api/dl/amd64
hxxp://43[.]228[.]157[.]68/api/dl/arm
hxxp://43[.]228[.]157[.]68/api/dl/arm64
hxxp://43[.]228[.]157[.]68/api/github-heartbeat
hxxp://43[.]228[.]157[.]68/api/github-results
f5b0b742-240a-4811-8a5b-b0ba6060685d.dnshook[.]site

Representative workflow and command pivots include:

/tmp/.svc
PANEL_URL
/api/github-heartbeat
/api/github-results
--exploit CVE-2026-41940
--source random,all
--envdump
--no-reverse

Payload hash

SHA-256  22f721fd3a81d2e27cbf90a122bb977f630c50b79daa98350f0e57b04dfa81f1

Treat infrastructure and hashes as time-bounded investigation pivots. The external delivery server lets the operator replace payloads without changing committed workflow code.

Defender guidance

GitHub and CI/CD

  • Search all branches and Git history—not only the default branch—for unexpected files under .github/workflows/, especially bursts of similarly structured workflows, raw-IP payload downloads, /tmp/.svc, the campaign endpoints, scanner flags, or the DNS callback.
  • Review Actions run history, workflow dispatches, push events, actor identity, workflow-file commits, runner logs, artifacts, and outbound network telemetry. Preserve these before disabling or deleting workflows.
  • Disable suspicious workflows, revoke active sessions and credentials for affected maintainers, rotate PATs and deploy keys, and review OAuth applications, GitHub Apps, SSH keys, branch protections, rulesets, and collaborator changes.
  • Require review or code-owner approval for .github/workflows/**, minimize default GITHUB_TOKEN permissions, pin third-party actions, constrain self-hosted runners, and restrict CI egress where operationally possible.
  • Do not assume removing the workflow contains the incident. Investigate whether stolen source-control tokens were used against other repositories or organizations.

Packagist and Composer

  • Identify use of the listed development versions, record the resolved source commit, and compare it with a trusted repository history before changing evidence.
  • Move to a reviewed stable release or known-good commit reference and regenerate lockfiles through a controlled process.
  • Distinguish package presence from execution: nested .github/workflows/ content under vendor/ is not automatically run by GitHub, but the source repository or a copied root-level workflow may still be compromised.

cPanel and WHM

  • Update to a cPanel-published fixed build for CVE-2026-41940, restrict administration to trusted paths, and run cPanel's current IOC-detection procedure on systems that were exposed while unpatched.
  • Treat vulnerable exposed servers as potentially compromised. Preserve cPanel/WHM, web, authentication, process, filesystem, and network evidence before cleanup.
  • Hunt for unauthorized panel sessions, account and SSH-key changes, web shells, modified login content, unexpected processes, configuration access, and use of the campaign infrastructure.
  • If compromise is suspected, isolate first, determine the accessible tenant and secret scope, then rotate root/panel, SSH, database, mail, cloud, source-control, payment, email-service, API, and application credentials from a clean environment.

Sources