Critical cPanel & WHM Vulnerability CVE-2023-29489 Lets Attackers Steal Cloud Credentials

Key Takeaways

• A widespread cyberattack campaign is leveraging GitHub Actions to target cPanel and WHM servers.
• Attackers are injecting malicious workflow files into compromised open-source repositories, using GitHub’s free compute resources for scanning and exploitation.
• The primary goal is to steal cloud credentials, payment information, and source control tokens from vulnerable web hosting environments.
• The campaign exploits CVE-2026-41940, an authentication bypass vulnerability in cPanel and WHM.
• Immediate patching of cPanel/WHM and review of GitHub Actions workflows are critical mitigation steps.

A sophisticated cyber campaign is actively exploiting GitHub Actions, transforming trusted open-source projects into instruments for attacking web hosting infrastructure. Threat actors are embedding malicious workflow files within compromised repositories, then utilizing GitHub’s free computational power to scan the public internet for susceptible targets.

This operation specifically focuses on cPanel and WHM servers, which are widely used to manage websites, email services, and databases for numerous organizations. Upon successful infiltration, the malware seeks to exfiltrate critical data, including cloud keys, payment credentials, and source control tokens, which could facilitate further unauthorized access and deeper compromise.

Security researchers at Socket.dev uncovered this campaign during their analysis of suspicious development versions within Packagist, a PHP package repository, linked to a legitimate PHP developer. Socket.dev said in a report that the true malicious code resided not within the PHP library itself, but rather within the GitHub Actions workflow files.

Between July 12 and 13, 2026, Packagist automatically synchronized malicious development versions across ten distinct packages associated with the compromised maintainer account. Each of these versions contained between 55 and 62 workflow files. These files are designed to initiate temporary Ubuntu runners, download a Linux-based payload, and commence scanning for vulnerable hosts.

The scope of this attack extends significantly beyond a single developer. Code searches for unique identifiers related to the campaign have revealed thousands of matching workflow files across unrelated repositories, indicating a broad and coordinated effort to hijack automation pipelines and steal sensitive information at scale.

Hackers Abuse GitHub Actions

The attack sequence begins when a compromised repository receives a push event or when a workflow is manually triggered. GitHub then provisions an ephemeral Ubuntu runner. This runner identifies its processor architecture and retrieves a corresponding Linux payload from a server controlled by the threat actor.

The deployed payload proceeds to scan common web ports, attempting to exploit CVE-2026-41940, an authentication bypass vulnerability affecting cPanel and WHM. A successful breach of a cPanel/WHM server can expose multiple customer accounts hosted on that system, along with databases, email configurations, and sensitive application secrets powering various websites.

The malicious workflows maintain communication with the command and control (C2) server by sending status heartbeats every thirty seconds. Stolen data is exfiltrated in small increments via HTTP POST requests. The exfiltrated data includes, but is not limited to, AWS credentials, GitHub and GitLab tokens, OpenAI and Google API keys, Stripe keys, and SSH material. This modus operandi bears resemblance to previous incidents involving compromised GitHub Actions that siphoned continuous integration secrets from trusted pipelines.

It is important to note that installing the related PHP packages on a developer’s local machine does not execute the malware. The nested workflow files remain inert within vendor folders after a standard installation. Only root-level GitHub Actions within compromised repositories serve as the actual attack engine, transforming free runners into reconnaissance and exploitation tools.

cPanel manages hosting tasks at the individual account level, while WHM operates at a higher tier, allowing the management of multiple cPanel accounts from a single control panel. This architectural hierarchy makes a compromise of a WHM panel particularly damaging for hosting providers and their numerous customers.

Campaign Scale and Defensive Guidance

The theft of source control tokens poses a significant risk, potentially leading to further repository takeovers and an escalating impact on the software supply chain over time. Hosting customers face the risk of their websites and private data being exposed if a single WHM panel is compromised. The campaign remains active despite the suspension of one GitHub account, indicating an ongoing threat that defenders must address promptly.

What You Should Do

• For Repository Owners: Immediately disable any suspicious workflows, preserve GitHub Actions logs for forensic analysis, and rotate all GitHub credentials without delay.
• For CI/CD Teams: Regularly review OAuth applications connected to your GitHub accounts and enforce approval requirements for any changes made within the .github/workflows folder.
• To Reduce Harm: Implement least privilege principles for all tokens, restrict the use of self-hosted runners where possible, and actively monitor logs for payload downloads originating from raw IP addresses.
• For Packagist Users: Exercise caution by avoiding unreviewed development versions of packages. Always pin your lockfiles to known good commits to ensure supply chain integrity.
• For cPanel/WHM Operators: Apply patches for cPanel and WHM promptly, especially in response to active exploitation of vulnerabilities like the cPanel authentication bypass (CVE-2026-41940).
• If Compromise is Suspected: Rotate every server-side secret, investigate any unauthorized sessions, and scrutinize unusual configuration changes.
• Review CI Workflows: Treat continuous integration workflows with the same rigorous security review as application code, given their elevated access to build systems.

Previous incidents, such as credential-focused npm package supply chain attacks, have demonstrated the rapid propagation of stolen cloud keys when warnings are not heeded. The indicators of compromise (IoCs) for this campaign are provided below to aid in detection and mitigation:

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.