The attack began with the compromise of the Packagist account belonging to a legitimate PHP and DevOps developer, dinushchathurya, sometime between July 12 and 13, 2026 . Packagist is designed to automatically synchronize package versions from their source repositories. This feature was weaponized: the attackers pushed malicious "dev-main" development versions of all ten packages associated with the developer's account, which Packagist then ingested and made available . The ten packages were legitimate PHP libraries, but the attack didn't target their users through PHP code.

583 Malicious Workflow Files

The core of the attack was not in the PHP code itself; the PHP libraries remained benign with no install hooks or malicious network activity . Instead, the attackers injected 583 malicious GitHub Actions workflow files (.github/workflows/*.yml) into the developer's source repositories. Each affected package version contained between 55 and 62 of these workflow files . GitHub Actions workflows are YAML files that define automated tasks, like running tests or deploying code. The attackers repurposed this legitimate automation infrastructure.

The Malicious Mechanism

Once a fork or copy of the compromised repository triggered a workflow (e.g., on a push event), the malicious .yml file instructed the GitHub-hosted Ubuntu runner to :

1. Detect the runner's CPU architecture.
2. Download a scanning and exploitation payload from a command-and-control (C2) server at IP address 43[.]228[.]157[.]68.
3. Scan the internet for systems running cPanel and WHM services.
4. Automatically exploit the identified systems using the vulnerability detailed below.
5. Exfiltrate stolen data back to the C2 server.

This effectively turned every triggered workflow into a scanning and exploitation node, using GitHub's free infrastructure as a distributed platform for the attack .

The Vulnerability: CVE-2026-41940

The target of the campaign was CVE-2026-41940, a critical vulnerability in cPanel and WebHost Manager (WHM) .

• Type: Pre-authentication authentication bypass .
• Severity: CVSS 9.8 (Critical) .
• Root Cause: A CRLF (Carriage Return Line Feed) injection vulnerability in the cpsrvd basic authentication handler . An unauthenticated attacker could send a crafted Authorization header containing raw newline characters. This allowed them to inject arbitrary properties into a session file, such as user=root and hasroot=1, effectively granting them root-level administrative access to the WHM interface without a valid password .
• Patch Date: cPanel released a security update on April 28, 2026 . This means attackers had a working patch to analyze for several months before this campaign began.

What Was Stolen

Once the exploit succeeded on a compromised cPanel/WHM server, the post-exploitation payload was designed to harvest a broad range of credentials and secrets. The primary targets included :

• Cloud Credentials: Amazon Web Services (AWS) keys.
• Source Control Tokens: GitHub tokens, GitLab tokens.
• API Keys: OpenAI, Google API keys.
• Payment Processing: Stripe keys.
• Email Service Credentials: (e.g., Mailgun, SendGrid).
• Infrastructure: SSH private keys, database credentials.
• Configuration Data: Git remote configurations.

The theft of such a wide range of credentials indicates a data-agnostic, opportunistic grab for any valuable access tokens present on the compromised server .

Campaign Scale: Thousands More Repositories Compromised

The 583 workflow files in the 10 Packagist packages were just the initial discovery. By pivoting on attacker indicators like a shared DNSHook callback domain and code-reuse patterns, researchers uncovered a much larger operation :

• ~6,100 workflow files were directly linked to the same initial attacker infrastructure .
• ~15,000 to 16,000 workflow files across GitHub were found to match related patterns from the campaign .

This massive discrepancy strongly suggests that the attackers compromised many more developer accounts and repositories beyond the single dinushchathurya account . The campaign was not a single-point failure but a coordinated, multi-account operation. The Hacker News reported a separate, earlier Packagist supply chain attack in May 2026 that compromised 8 packages with related malicious elements , further highlighting the ecosystem's vulnerability.

Ongoing Risk: Why the Campaign is Likely Still Active

The campaign poses a persistent threat because the attacker's infrastructure is not entirely neutralized. The campaign may continue through :

• Forks and Mirrors: Malicious workflow files may persist in forked or mirrored copies of the compromised repositories.
• Cached Snapshots: GitHub's own caches may contain the malicious workflow versions.
• Stolen Credentials: The credentials already exfiltrated remain in the attacker's possession and can be used for lateral movement or future attacks.
• Surviving C2 Infrastructure: The C2 server (43[.]228[.]157[.]68) may still be operational and actively receiving data .

While the original developer's Packagist account has been suspended, the sheer scale of matching workflow files (up to ~16,000) means the operation has a wide footprint that is difficult to completely eradicate .

Defensive Actions Required

Based on the published analysis, organizations and developers should take the following actions immediately :

1. Patch cPanel/WHM Immediately: CVE-2026-41940 was patched on April 28, 2026. Any cPanel or WHM installation (versions after 11.40) that is not updated is trivially exploitable by unauthenticated remote attackers. This is the single most important step.
2. Audit All GitHub Actions Workflows: Review every workflow YAML file in your repositories, especially those that:
   • Download and execute external binaries.
   • Make outbound network connections.
   • Run on push or workflow_dispatch triggers without manual review.
   • Are present in development or feature branches that may be automatically synced by a package manager.
3. Rotate All Exposed Credentials: Assume that any credential present on a compromised cPanel/WHM server has been stolen. This includes, but is not limited to:
   • Cloud provider keys (AWS, GCP, Azure).
   • API tokens (OpenAI, Google, Stripe).
   • SSH keys and database passwords.
   • Source-code management tokens (GitHub, GitLab).
4. Check for Known Indicators of Compromise (IOCs): Search your logs for network connections to the attacker's C2 IP address (43[.]228[.]157[.]68) and the known DNSHook callback domain .
5. Harden Repositories and Package Management:
   • Enable branch protection rules on all development branches.
   • Require signed commits.
   • Avoid auto-syncing package registries (like Packagist) directly from repository branches without a review step .
6. Review Packagist Development Versions: When auditing dependencies, specifically examine development versions (dev-master, dev-main) for unexpected .github/workflows/ files, as the PHP code itself may be clean while the attack lives entirely in the CI/CD configuration .

The attack began with the compromise of the Packagist account belonging to a legitimate PHP and DevOps developer, dinushchathurya, sometime between July 12 and 13, 2026 . Packagist is designed to automatically synchronize package versions from their source repositories. This feature was weaponized: the attackers pushed malicious "dev-main" development versions of all ten packages associated with the developer's account, which Packagist then ingested and made available . The ten packages were legitimate PHP libraries, but the attack didn't target their users through PHP code.

583 Malicious Workflow Files

The core of the attack was not in the PHP code itself; the PHP libraries remained benign with no install hooks or malicious network activity . Instead, the attackers injected 583 malicious GitHub Actions workflow files (.github/workflows/*.yml) into the developer's source repositories. Each affected package version contained between 55 and 62 of these workflow files . GitHub Actions workflows are YAML files that define automated tasks, like running tests or deploying code. The attackers repurposed this legitimate automation infrastructure.

The Malicious Mechanism

Once a fork or copy of the compromised repository triggered a workflow (e.g., on a push event), the malicious .yml file instructed the GitHub-hosted Ubuntu runner to :

1. Detect the runner's CPU architecture.
2. Download a scanning and exploitation payload from a command-and-control (C2) server at IP address 43[.]228[.]157[.]68.
3. Scan the internet for systems running cPanel and WHM services.
4. Automatically exploit the identified systems using the vulnerability detailed below.
5. Exfiltrate stolen data back to the C2 server.

This effectively turned every triggered workflow into a scanning and exploitation node, using GitHub's free infrastructure as a distributed platform for the attack .

The Vulnerability: CVE-2026-41940

The target of the campaign was CVE-2026-41940, a critical vulnerability in cPanel and WebHost Manager (WHM) .

• Type: Pre-authentication authentication bypass .
• Severity: CVSS 9.8 (Critical) .
• Root Cause: A CRLF (Carriage Return Line Feed) injection vulnerability in the cpsrvd basic authentication handler . An unauthenticated attacker could send a crafted Authorization header containing raw newline characters. This allowed them to inject arbitrary properties into a session file, such as user=root and hasroot=1, effectively granting them root-level administrative access to the WHM interface without a valid password .
• Patch Date: cPanel released a security update on April 28, 2026 . This means attackers had a working patch to analyze for several months before this campaign began.

What Was Stolen

Once the exploit succeeded on a compromised cPanel/WHM server, the post-exploitation payload was designed to harvest a broad range of credentials and secrets. The primary targets included :

• Cloud Credentials: Amazon Web Services (AWS) keys.
• Source Control Tokens: GitHub tokens, GitLab tokens.
• API Keys: OpenAI, Google API keys.
• Payment Processing: Stripe keys.
• Email Service Credentials: (e.g., Mailgun, SendGrid).
• Infrastructure: SSH private keys, database credentials.
• Configuration Data: Git remote configurations.

The theft of such a wide range of credentials indicates a data-agnostic, opportunistic grab for any valuable access tokens present on the compromised server .

Campaign Scale: Thousands More Repositories Compromised

The 583 workflow files in the 10 Packagist packages were just the initial discovery. By pivoting on attacker indicators like a shared DNSHook callback domain and code-reuse patterns, researchers uncovered a much larger operation :

• ~6,100 workflow files were directly linked to the same initial attacker infrastructure .
• ~15,000 to 16,000 workflow files across GitHub were found to match related patterns from the campaign .

This massive discrepancy strongly suggests that the attackers compromised many more developer accounts and repositories beyond the single dinushchathurya account . The campaign was not a single-point failure but a coordinated, multi-account operation. The Hacker News reported a separate, earlier Packagist supply chain attack in May 2026 that compromised 8 packages with related malicious elements , further highlighting the ecosystem's vulnerability.

Ongoing Risk: Why the Campaign is Likely Still Active

The campaign poses a persistent threat because the attacker's infrastructure is not entirely neutralized. The campaign may continue through :

• Forks and Mirrors: Malicious workflow files may persist in forked or mirrored copies of the compromised repositories.
• Cached Snapshots: GitHub's own caches may contain the malicious workflow versions.
• Stolen Credentials: The credentials already exfiltrated remain in the attacker's possession and can be used for lateral movement or future attacks.
• Surviving C2 Infrastructure: The C2 server (43[.]228[.]157[.]68) may still be operational and actively receiving data .

While the original developer's Packagist account has been suspended, the sheer scale of matching workflow files (up to ~16,000) means the operation has a wide footprint that is difficult to completely eradicate .

Defensive Actions Required

Based on the published analysis, organizations and developers should take the following actions immediately :

1. Patch cPanel/WHM Immediately: CVE-2026-41940 was patched on April 28, 2026. Any cPanel or WHM installation (versions after 11.40) that is not updated is trivially exploitable by unauthenticated remote attackers. This is the single most important step.
2. Audit All GitHub Actions Workflows: Review every workflow YAML file in your repositories, especially those that:
   • Download and execute external binaries.
   • Make outbound network connections.
   • Run on push or workflow_dispatch triggers without manual review.
   • Are present in development or feature branches that may be automatically synced by a package manager.
3. Rotate All Exposed Credentials: Assume that any credential present on a compromised cPanel/WHM server has been stolen. This includes, but is not limited to:
   • Cloud provider keys (AWS, GCP, Azure).
   • API tokens (OpenAI, Google, Stripe).
   • SSH keys and database passwords.
   • Source-code management tokens (GitHub, GitLab).
4. Check for Known Indicators of Compromise (IOCs): Search your logs for network connections to the attacker's C2 IP address (43[.]228[.]157[.]68) and the known DNSHook callback domain .
5. Harden Repositories and Package Management:
   • Enable branch protection rules on all development branches.
   • Require signed commits.
   • Avoid auto-syncing package registries (like Packagist) directly from repository branches without a review step .
6. Review Packagist Development Versions: When auditing dependencies, specifically examine development versions (dev-master, dev-main) for unexpected .github/workflows/ files, as the PHP code itself may be clean while the attack lives entirely in the CI/CD configuration .