GitHub Actions Under Attack: How Cybercriminals Are Exploiting CI/CD Runners to Find Vulnerable cPanel Servers

The Dark Side of Automation

Here's something that should make every developer and sysadmin pause: your own CI/CD pipeline might be working against you. Security researchers have uncovered a disturbing new attack vector where cybercriminals are exploiting GitHub Actions to create an automated botnet that searches for vulnerable servers.

This campaign specifically targets CVE-2026-41940, a critical vulnerability in cPanel that remains unpatched on thousands of servers worldwide. The attackers have found a clever way to weaponize GitHub's infrastructure by creating malicious workflows that execute scanning operations directly from GitHub's servers—effectively using Microsoft's own resources to conduct their hostile reconnaissance.

How the Attack Works

The mechanics are both clever and concerning. Threat actors create GitHub repositories containing malicious GitHub Actions workflows. These workflows contain code that:

• Executes network scanning operations against IP ranges
• Tests for the presence of unpatched cPanel installations
• Identifies servers vulnerable to CVE-2026-41940
• Reports findings back to the attacker's infrastructure

What's particularly troubling is that these scans originate from GitHub's IP addresses, making them difficult to block without potentially affecting legitimate GitHub functionality. The scanning operations run on GitHub's runners—servers that execute CI/CD jobs—which means the computational burden falls on Microsoft rather than the attackers.

Why This Matters for Your Infrastructure

If you're running cPanel on any of your servers, this campaign should be on your radar immediately. Here's the uncomfortable reality: GitHub Actions generates millions of workflow executions daily, and embedded within that massive volume are now malicious operations conducting hostile reconnaissance.

The attackers don't need to invest in their own server infrastructure. They've essentially co-opted GitHub's global network of runners to do their dirty work for free. This is automation weaponized at scale.

What You Should Do Right Now

1. Patch immediately. If you're running cPanel and haven't applied updates addressing CVE-2026-41940, treat this as a critical priority. Your unpatched server is likely being scanned right now.

2. Monitor your access logs. Look for unusual patterns of connection attempts from GitHub IP ranges, particularly those associated with GitHub Actions runners.

3. Implement IP-based restrictions. Consider limiting cPanel access to known IP addresses or implementing stricter authentication requirements.

4. Review your GitHub organization settings. Ensure your workflows are coming from trusted sources and audit any suspicious repository creation.

The Bigger Picture

This campaign illustrates a troubling evolution in cyberattacks. As our development workflows become more automated and cloud-dependent, attackers are adapting their strategies to exploit these very systems. GitHub Actions, CircleCI, and similar platforms represent trusted infrastructure that can be turned against us.

At NameOcean, we consistently emphasize the importance of keeping your hosting environment secure. Whether you're running a simple WordPress site or a complex web application, vulnerabilities in your control panels and server software can expose your entire infrastructure to compromise.

Stay vigilant, keep your systems updated, and treat security as an ongoing process rather than a one-time configuration.

Has this affected your infrastructure? Share your experiences in the comments below. If you need help securing your NameOcean hosting environment, our support team is standing by.