🔺 New research: Malicious Packagist development versions exposed a large-scale GitHub Actions abuse campaign. Compromised repositories launch runners to exploit a cPanel & WHM authentication bypass, then harvest credentials and other server-side secrets. https://socket.dev/blog/github-actions-abuse-powers-cpanel-and-whm-exploitation