Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

Attackers compromised ten PHP packages on Packagist by injecting malicious GitHub Actions workflows that turn GitHub runners into distributed attack infrastructure targeting cPanel and WHM servers via CVE-2026-41940, harvesting credentials and secrets at scale.

This Wire brief sits within Fusion42's coverage of Cybersecurity, Developer Tools and Cloud Infrastructure. Wire is Fusion42's founder-focused intelligence feed: each story is connected to the funds and startups it names — every one with a live profile on Raise or Scout — so founders can follow the capital and the momentum behind the headline rather than just the headline itself. Wire analysis is one of the live surfaces Arthur reasons over.