Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

Cybersecurity researchers have discovered a large-scale campaign that utilizes compromised GitHub repositories as a means to target cPanel and WebHost Manager servers. The campaign involves malicious development versions of Packagist packages, specifically 10 packages linked to a legitimate PHP and DevOps developer. These packages were compromised between July 12 and 13. The attackers are leveraging GitHub Actions runners to carry out the attacks. The targeted servers are cPanel and WebHost Manager instances. The malicious activity is associated with a developer named dinushchathurya.