GitHub Actions hijacked to scan cPanel/WHM: 10 PHP packages compromised and CVE-2026-41940 exploited at scale

Socket.dev documented a campaign where 583 GitHub Actions workflows slipped into 10 PHP packages scan the Internet for cPanel/WHM instances vulnerable to the CVE-2026-41940 authentication bypass - to steal almost all available credentials. Approximately 6,100 workflows bear the campaign's signature on GitHub.

The facts

Socket.dev detailed on July 23, 2026, a campaign where GitHub Actions workflows transformed into scanners are used to exploit the vulnerability CVE-2026-41940, an authentication bypass in cPanel and WebHost Manager (WHM). Researcher Kirill Boychenko attributes the campaign to a cluster with tactical overlaps with Water Curse, previously tracked by Trend Micro.

How it works

Between July 12 and 13, 2026, attackers compromised ten PHP packages published under the maintainer account dinushchathurya:

• nationality-list
• srilankan-divisional-secretariats
• srilankan-gn-divisions
• srilankan-local-authorities
• srilankan-mobile-number-validator
• srilankan-state-hospitals
• srilankan-universities
• uk-mobile-number-validator
• uk-post-code
• websmslk

In each package, they did not modify the PHP code itself. They slipped 55 to 62 GitHub Actions workflow files - 583 in total. These workflows, triggered by a push or manual execution, launch runners hosted by GitHub that download a Linux payload from 43.228.157[.]68, with binaries for x86 (32/64-bit) and ARM (32/64-bit).

The payload then attempts to exploit CVE-2026-41940 on accessible cPanel/WHM instances to steal anything that can be monetized: AWS credentials, GitHub and GitLab tokens, OpenAI and Google keys, Stripe keys, SendGrid and Mailgun credentials, database contents, SSH keys, remote Git repositories, and remote code execution results.

The scale

Socket.dev reports approximately 6,100 workflow files on GitHub that contain the unique DNSHook identifier f5b0b742-240a-4811-8a5b-b0ba6060685d. The campaign therefore far exceeds the single compromised maintainer. The infrastructure is linked to the email ischhfd83@rambler[.]ru.

Who is impacted

• Any organization that has integrated one of the ten dinushchathurya/* packages into its PHP chain.
• Any cPanel/WHM instance exposed on the Internet and not patched against CVE-2026-41940.

68 outbound and grep the DNSHook identifier f5b0b742-240a-4811-8a5b-b0ba6060685d in your repositories, workflows, and DNS logs. 4. Rotate all API keys and credentials deployed on exposed instances - consider anything that has passed through a potentially affected environment as compromised."]

Analysis

The trick is elegant and worrying: instead of slipping a backdoor into PHP code - quickly spotted by linters and reviews - attackers place their payloads in CI workflows, which historically have less editorial control and direct access to runners with Internet output. This is the second major mutation of the same theme we have documented in recent months, after FakeGit and SmartLoader: GitHub is no longer just a code repository, it is also an execution infrastructure offered for free to those who know how to turn it around. A project's supply chain is no longer just composer.lock; it is also the content of .github/workflows/ of all its dependencies.