Large-Scale GitHub Actions Abuse Powers a Distributed cPanel and WHM Exploitation Campaign

Reported 23 Jul 2026 by otx · Severity: medium

A large-scale campaign exploited GitHub Actions by compromising repositories to launch distributed attacks against cPanel and WHM servers. The operation began with compromised developer accounts, pushing malicious workflow files that executed on GitHub-hosted runners rather than