CVE
CVE-2026-41940, CVE-2026-64600, CVE-2026-44891, CVE-2026-55831, CVE-2026-55833
CWE
CWE-93, CWE-362, CWE-367, CWE-400, CWE-494, CWE-506, CWE-770
Affected Surface
- GitHub repositories, Actions runners, and package consumers exposed to the week's compromised Packagist and npm artifacts
- Internet-facing cPanel/WHM servers and Linux XFS reflink hosts where untrusted code could turn a foothold into server or host compromise
- Java services that still ship vulnerable Netty STOMP or SPDY decoder paths
Welcome to Corgea’s weekly briefing. The briefing covers the most important security findings and research from the week.
This edition covers research published from Wednesday, 22 July through Tuesday, 28 July 2026, excluding items already covered in the 21 July briefing.
Top Article
GitHub Actions abuse turned ten Packagist dev packages into a Linux scanner for cPanel/WHM CVE-2026-41940
This week’s most important story is the GitHub Actions and cPanel campaign, because it turns repository compromise into reusable attack infrastructure. Socket deserves first public-disclosure and campaign-analysis credit for tying compromised dinushchathurya/* development versions to 583 malicious workflow files, while cPanel deserves patch and response credit for CVE-2026-41940, and CISA’s KEV listing confirms the downstream bug was already being exploited in the wild. The story belongs beside the AsyncAPI require-time workflow compromise, the GitHub workstation breach via a poisoned VS Code extension, and this week’s ViteVenom blockchain loader chain: in each case, the trusted release or CI path became the real malware runtime.
The key thing to remember is that the package artifacts were only the breadcrumb. The attacker used GitHub-hosted Ubuntu runners to scan the internet, exploit cPanel and WHM, and upload cloud, database, source-control, and application secrets. That makes this a supply-chain attack on the same operational layer targeted by TeamPCP’s multi-platform credential hunting, SleeperGem’s developer-machine persistence, and PolinRider’s repo and browser lure ecosystem: attackers are increasingly treating CI and source-control plumbing as ready-made infrastructure.
More news
ViteVenom: seven fake Vite npm scopes used blockchain dead-drops to launch a detached RAT
This deserves close attention because it shows how far package-delivered tradecraft has moved beyond obvious postinstall hooks. Checkmarx deserves first public-disclosure and reverse-engineering credit for mapping the seven malicious packages, the shared bin/vite.js loader, and the Tron, Aptos, and BSC dead-drop chain, while The Hacker News and SC Media helped widen awareness. Operationally, ViteVenom sits in the same family as the Rollup polyfill import-time RAT, jscrambler’s evolving npm compromise, and PolinRider’s blockchain-backed loader design.
What matters most is the detached-execution path. Once the fake Vite binary ran, the package could recover second-stage payload pointers from public blockchains and spawn a background Node process meant to outlive the original command. Subscribers should read that as the workstation-side twin of the GitHub Actions cPanel campaign: whether execution starts in a CLI helper or a CI workflow, the attacker is using ordinary developer-tooling surfaces to bootstrap persistent access.
CVE-2026-64600: RefluXFS turns XFS reflink races into Linux root
Qualys deserves disclosure, exploit-analysis, and fix-validation credit for RefluXFS, and this is the week’s most important pure host-boundary vulnerability because it turns ordinary local code execution into root on common XFS deployments. The bug belongs beside Bad Epoll, Dirty Frag, and Fragnesia: once a malicious package, compromised build step, or low-privilege application bug gets a foothold, the kernel can provide the second stage.
The operational lesson is that “local-only” should not be treated as low priority on developer workstations, self-hosted runners, or multi-tenant Linux hosts. If a vulnerable XFS reflink=1 filesystem also holds both writable scratch space and sensitive root-owned files, an attacker can turn the same kind of local execution delivered by ViteVenom, jscrambler, or SleeperGem into durable host-root compromise.
Other news:
- CVE-2026-44891, 55831, and 55833: Netty 4.1.136 / 4.2.16 patch STOMP and SPDY DoS primitives - Netty’s maintainers deserve coordinated advisory and patch credit for the July decoder fixes, and the three CVEs are a useful companion read to the earlier Netty HTTP, HTTP/2, and Redis fix train, Keras deserialization RCE, and protobufjs schema code execution: parser correctness and parser safety are still different problems.
- For adjacent context, revisit the 21 July briefing, the 14 July briefing, and companion July research on ViteVenom, RefluXFS, jscrambler, and the GitHub Actions/cPanel exploitation mesh.
From research to remediation
Check whether this pattern exists in your codebase
Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.