How Attackers Turned GitHub Actions Into a Weapon Against cPanel Servers

Michael Miller · 2026-07-23

Cybersecurity researchers have uncovered a large-scale campaign that weaponized compromised GitHub repositories, turning them into distributed attack infrastructure targeting cPanel and WebHost Manager (WHM) instances. This isn't your typical supply chain attack. It's a clever twist that shows how attackers are getting more creative with the tools developers trust every day. ### The Attack in a Nutshell The activity involves malicious Packagist development versions spanning 10 packages. These packages are linked to a legitimate PHP and DevOps developer named dinushchathurya. The attack unfolded between July 12 and 13, with the bad actors exploiting GitHub Actions runners to do their dirty work. Here's what happened: - Attackers compromised legitimate GitHub repositories - They injected malicious code into Packagist development versions - The payload targeted cPanel and WHM servers specifically - GitHub Actions runners were used as the delivery mechanism ### Why This Matters for Web Hosting Pros If you manage cPanel or WHM servers, this campaign should be on your radar. The attackers didn't just go after random targets. They focused on server management software that powers millions of websites worldwide. Think about it this way: cPanel and WHM are like the control rooms for web hosting. If someone gets access to those, they can do a lot of damage. They can steal data, install backdoors, or use your servers to launch other attacks. "This is a wake-up call for anyone relying on automated CI/CD pipelines," says one security expert who analyzed the campaign. "The tools we use to build software can be turned against us." ### How GitHub Actions Became a Weapon GitHub Actions is a popular automation tool that lets developers build, test, and deploy code. It's incredibly useful. But in this case, attackers found a way to abuse it. They turned compromised repositories into launch pads. Instead of using their own servers, they used GitHub's infrastructure to distribute malware. This makes the attack harder to trace and block. The attackers focused on Packagist, which is the main package repository for PHP. By poisoning development versions of legitimate packages, they could infect systems that automatically pulled in updates. ### Protecting Your cPanel and WHM Servers So what can you do to stay safe? Here are some practical steps: - **Audit your dependencies**: Review every package you use, especially development versions - **Pin your versions**: Don't let your systems automatically pull in the latest dev versions - **Monitor your GitHub repos**: Watch for suspicious activity in your repositories - **Use security tools**: Implement vulnerability scanners that check your dependencies - **Limit CI/CD permissions**: Make sure your GitHub Actions runners don't have more access than they need ### The Bigger Picture This campaign shows that supply chain attacks are getting more sophisticated. Attackers aren't just targeting code anymore. They're targeting the infrastructure that builds and deploys that code. For developers and hosting professionals, this means we need to think differently about security. It's not enough to secure your production servers. You also need to secure your development pipeline. The good news is that campaigns like this get attention. Researchers are now digging deeper into how GitHub Actions can be abused. Expect to see better security measures coming soon. ### Final Thoughts This attack on cPanel and WHM servers through GitHub Actions is a reminder that no tool is safe from abuse. Stay vigilant, keep your systems updated, and always question where your code is coming from. If you manage hosting infrastructure, take this as a sign to review your security practices. A few hours of prevention now could save you weeks of cleanup later.