Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

Cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack infrastructure designed to target cPanel and WebHost Manager (WHM) instances. The activity involves malicious Packagist development versions spanning 10 packages associated with a legitimate PHP and DevOps developer, dinushchathurya, between July 12 and 13,

The reported campaign compromises GitHub repositories and abuses GitHub Actions hosted runners as a distributed attack infrastructure to exploit cPanel/WHM servers vulnerable to CVE-2026-41940, using hundreds of malicious workflows embedded in multiple Packagist PHP packages.[1][2][4][5] The articles describe weaponized CI/CD automation, large-scale scanning, exploitation, and credential theft, but do not mention direct AI models; instead they highlight risks in development and automation pipelines.[1][3][5] From a RealGround perspective, this is an AI/automation supply chain and CI/CD integrity issue: similar techniques could be used to tamper with AI training pipelines, model deployment workflows, or data ingestion jobs, so organizations should harden GitHub Actions policies, review workflow changes, monitor runner egress, and maintain SBOMs and provenance for third-party packages.[1][3][6] Practically, AI teams should treat CI/CD runners and workflow files as part of the AI supply chain, enforce review and least privilege, and continuously red-team automated pipelines to detect malicious workflows before they impact models or sensitive data.