GitHub Actions Abused to Exploit CVE-2026-41940 in cPanel and WHM
An early warning indicates that GitHub Actions in compromised repositories are being abused to exploit CVE-2026-41940 in cPanel and WHM, potentially leading to credential theft.
What happened
Reportedly, a large-scale campaign has been leveraging compromised GitHub repositories to target cPanel and WHM instances. Malicious GitHub Actions workflows have been added to these repositories, which, when triggered, download a Linux payload from attacker-controlled infrastructure. This payload scans for and exploits CVE-2026-41940, an authentication bypass vulnerability, to gain elevated control over the control panel and harvest various sensitive data including credentials and configuration files.
The campaign appears to involve malicious development versions of PHP packages associated with a legitimate developer, which were compromised between July 12 and 13, 2026. The PHP libraries themselves were not the execution path; instead, the malicious GitHub Actions workflows were the primary mechanism for launching the attack.
Professional software engineers are advised to investigate and monitor their GitHub Actions for any suspicious activity. Additionally, reviewing cPanel and WHM configurations for potential compromises is recommended. Primary sources should be consulted for the most accurate and up-to-date information on this ongoing investigation.
How 0Day mitigates this
cpanel is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.