A widespread software supply chain attack has been uncovered where threat actors compromised open-source developer accounts to turn continuous integration pipelines into distributed exploitation infrastructure. The automated runners execute automated network probes to locate and compromise vulnerable web hosting management platforms.
The campaign compromised ten Packagist development packages associated with a popular PHP developer, inserting over 580 malicious GitHub Actions workflow YAML files. When triggered, the automated workflows spin up GitHub-hosted runners, download architecture-specific Linux scanning binaries, and probe external networks for cPanel and WebHost Manager instances vulnerable to authentication bypass flaw CVE-2026-41940. Successful exploitation lets the attackers steal server configuration files, database credentials, SSH keys, and payment service tokens.
Abusing public cloud integration runners to host distributed attack infrastructure allows adversaries to mask scanning traffic behind trusted cloud IP blocks. Once an attacker bypasses authentication on a hosting management engine, they acquire complete administrative control over all hosted customer websites and backend databases.
– Audit automated build pipeline configurations and third-party dependency references for unauthorized workflow additions.
– Restrict continuous integration runners from initiating outbound network connections to unverified external IP ranges.
– Update cPanel and WebHost Manager software instances immediately to seal the authentication bypass vulnerability.
– Rotate all administrative passwords, SSH keys, and cloud access tokens managed on exposed server instances.
Build automation defense demands rigorous supply chain verification to ensure third-party repository integrations cannot be subverted into automated scanning platforms. #CodeDefence #SupplyChain #GitHub #cPanel #AuthBypass #DevOps #AppSec
/
