{"id":10306,"date":"2026-07-25T08:00:43","date_gmt":"2026-07-25T12:00:43","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=10306"},"modified":"2026-07-25T04:46:39","modified_gmt":"2026-07-25T08:46:39","slug":"github-actions-abused-to-attack-hosting-servers","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/","title":{"rendered":"GitHub Actions abused to attack hosting servers"},"content":{"rendered":"<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">A security researcher just uncovered something unsettling: attackers turning <a href=\"https:\/\/github.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">GitHub<\/a>&#8216;s own automation tools into a sprawling botnet aimed squarely at web hosting infrastructure, with cPanel and WHM servers as the primary target.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Researchers at <a href=\"https:\/\/socket.dev\/blog\/github-actions-abuse-powers-cpanel-and-whm-exploitation\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Socket first<\/a> spotted the campaign after finding malicious development versions hidden across ten Packagist PHP packages tied to a legitimate developer whose GitHub account attackers had compromised. The packages themselves weren&#8217;t the actual weapon. They contained ordinary reference data and lookup functions, nothing that would trigger malware on install. The real danger sat somewhere less obvious: hundreds of GitHub Actions workflow files the attacker buried in each repository, ready to activate under the right conditions.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Here&#8217;s the part that makes this campaign genuinely clever. Simply installing the compromised packages through Composer wouldn&#8217;t trigger anything, since GitHub ignores nested workflow files buried inside a dependency&#8217;s vendor directory. The attack only springs to life when someone pushes to the compromised repository directly or manually triggers the workflows. At that point, GitHub spins up its own disposable Ubuntu-based runners and hands them straight over to attacker-controlled code, essentially turning GitHub&#8217;s own infrastructure into free attack compute.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Once active, those runners detect their processor architecture and pull down a matching payload from an attacker-controlled server. From there, the payload runs an internet-scale scanner built to exploit a known vulnerability in <a href=\"https:\/\/hostingdiscussion.com\/news\/cpanel-issues-critical-updates-to-patch-high-risk-security-flaws\/\">cPanel<\/a> and WHM deployments, while simultaneously harvesting anything valuable it can find: AWS credentials, GitHub and GitLab tokens, API keys for services like OpenAI and Stripe, database logins, and SSH data. The workflows stream all of it back to the attacker in real time through a heartbeat system that reports in every 30 seconds, letting whoever&#8217;s running this monitor thousands of compromised runners simultaneously.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">The scale here is what&#8217;s genuinely alarming. Searching GitHub&#8217;s codebase for unique identifiers tied to this campaign&#8217;s command-and-control infrastructure turned up somewhere between 15,000 and 16,000 matching workflow files scattered across unrelated repositories, far beyond the original compromised developer account. That doesn&#8217;t necessarily mean tens of thousands of confirmed victims, since forks and cloned repositories inflate the count, but it does confirm this extends well past one isolated incident.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\"><a href=\"https:\/\/hostingdiscussion.com\/news\/microsoft-taps-aws-to-add-capacity-for-strained-github-platform\/\">GitHub<\/a> has since suspended the compromised developer account, cutting off one entry point. Given the surviving forks, mirrors, and still-active infrastructure behind it, researchers are treating this as an ongoing threat rather than a closed case.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A security researcher just uncovered something unsettling: attackers turning GitHub&#8216;s own automation tools into a sprawling botnet aimed squarely at web hosting infrastructure, with cPanel and WHM servers as the primary target. Researchers at Socket first spotted the campaign after finding malicious development versions hidden across ten Packagist PHP packages tied to a legitimate developer [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[71],"tags":[203,7501,1998,7499,6860,7500],"class_list":["post-10306","post","type-post","status-publish","format-standard","hentry","category-featured","tag-cpanel","tag-credential-theft-botnet","tag-github","tag-github-actions-abuse","tag-supply-chain-attack","tag-whm-vulnerability"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>GitHub Actions abused to attack hosting servers - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GitHub Actions abused to attack hosting servers - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"A security researcher just uncovered something unsettling: attackers turning GitHub&#8216;s own automation tools into a sprawling botnet aimed squarely at web hosting infrastructure, with cPanel and WHM servers as the primary target. Researchers at Socket first spotted the campaign after finding malicious development versions hidden across ten Packagist PHP packages tied to a legitimate developer [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-25T12:00:43+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-25T08:46:39+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/\",\"name\":\"GitHub Actions abused to attack hosting servers - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-07-25T12:00:43+00:00\",\"dateModified\":\"2026-07-25T08:46:39+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GitHub Actions abused to attack hosting servers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"GitHub Actions abused to attack hosting servers - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/","og_locale":"en_US","og_type":"article","og_title":"GitHub Actions abused to attack hosting servers - Web Hosting News","og_description":"A security researcher just uncovered something unsettling: attackers turning GitHub&#8216;s own automation tools into a sprawling botnet aimed squarely at web hosting infrastructure, with cPanel and WHM servers as the primary target. Researchers at Socket first spotted the campaign after finding malicious development versions hidden across ten Packagist PHP packages tied to a legitimate developer [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/","og_site_name":"Web Hosting News","article_published_time":"2026-07-25T12:00:43+00:00","article_modified_time":"2026-07-25T08:46:39+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/","url":"https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/","name":"GitHub Actions abused to attack hosting servers - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-07-25T12:00:43+00:00","dateModified":"2026-07-25T08:46:39+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/github-actions-abused-to-attack-hosting-servers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"GitHub Actions abused to attack hosting servers"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":98,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10306","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=10306"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10306\/revisions"}],"predecessor-version":[{"id":10307,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10306\/revisions\/10307"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=10306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=10306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=10306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}