GitHub Actions Abused in Campaign Targeting cPanel Servers

Attackers compromised GitHub repositories to use GitHub Actions runners as distributed infrastructure targeting cPanel and WHM instances. The campaign involved 10 malicious Packagist packages linked to developer dinushchathurya between July 12-13. The abuse turns legitimate CI/CD resources into attack vectors for server compromise.