🟠 High | Source: The Hacker News
Attackers compromised GitHub repositories belonging to a legitimate PHP developer to distribute malicious Packagist packages that weaponise GitHub Actions runners against cPanel and WHM hosting control panel instances. The campaign involved at least 10 tampered development-version packages published over a two-day window in July, effectively turning trusted CI/CD infrastructure into a distributed attack platform. This matters because it demonstrates how supply chain compromise via package registries can be used to pivot into web hosting infrastructure at scale.
Security Architect’s Take: Audit all Packagist dependencies — particularly development versions — for unexpected maintainer changes or suspicious release activity, and enforce allowlists for third-party GitHub Actions in your CI/CD pipelines. If your organisation runs cPanel or WHM, review access logs for anomalous authentication attempts and consider restricting API access to known IP ranges.
Original advisory: Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers