Open‑source Software Supply Chain Hit by New Critical Libssh2 Flaw and GitHub Actions Abuse

Security researcher "bikini" published "Exploitarium," a GitHub archive of proof‑of‑concept exploits for more than 15 open‑source projects. The most serious entry is CVE‑2026‑55200, a critical memory‑corruption bug in libssh2 (up to version 1.11.1) that enables unauthenticated remote code execution on any client that connects to a malicious SSH server. Public release of the PoC narrows the remediation window and raises the risk of rapid weaponisation across the software supply chain.

In a separate campaign, threat actors compromised a PHP developer’s Packagist packages and inserted dozens of malicious GitHub Actions workflow files. The workflows launch GitHub‑hosted runners that download a Linux payload and probe for vulnerable cPanel/WHM servers vulnerable to CVE‑2026‑41940, an authentication‑bypass flaw. Ten affected packages contain a total of 583 malicious workflow files, allowing attackers to harvest credentials, configuration data, and other secrets from compromised control panels.

Both incidents underline the urgency of updating affected components, auditing dependencies, employing Software Bill of Materials, and restricting network access to trusted endpoints.