Vulnerabilities & Exploits · Supply Chain
GitHub checkout starts failing unsafe PR workflows GitHub is turning a quiet trust leak into a visible failure. The problem is not the checkout step itself. It is privileged automation that runs code from a forked pull request with the base repository’s token, secrets, cache access, and runner environment.
GitHub Actions checkout v7 now blocks common pwn-request patterns by default in pull_request_target and certain workflow_run events. GitHub said the protection is live now in v7 and will be backported to supported major versions on July 16, 2026, so workflows pinned to floating major tags should pick it up automatically.
The breakage is deliberate. Privileged PR jobs that used to succeed may now fail because they were implicitly trusting unreviewed fork code, and that failure exposes secret-exposure patterns maintainers may not have noticed.
3 sources · Jun 23
Timeline Sources Jun 23 The Hacker News
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns
GitHub’s actions/checkout v7 now blocks risky fork PR checkouts in privileged workflows to reduce common pwn request attacks.
original Jun 22 CSO Online
GitHub Actions hardens checkout security to block ‘pwn request’ attacks
After years of trying to educate developers to use pull_request_target securely, the platform finally implements stronger defaults.
original Jun 20 Socket.dev
GitHub Actions Checkout Now Blocks Risky pull_request_target...
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.
original Part of the PlainSec briefing for 2026-06-24
Every edition of this story: GitHub checkout starts failing unsafe PR workflows
More from today Vulnerabilities & Exploits · Supply Chain
GitHub checkout starts failing unsafe PR workflows GitHub is turning a quiet trust leak into a visible failure. The problem is not the checkout step itself. It is privileged automation that runs code from a forked pull request with the base repository’s token, secrets, cache access, and runner environment.
GitHub Actions checkout v7 now blocks common pwn-request patterns by default in pull_request_target and certain workflow_run events. GitHub said the protection is live now in v7 and will be backported to supported major versions on July 16, 2026, so workflows pinned to floating major tags should pick it up automatically.
The breakage is deliberate. Privileged PR jobs that used to succeed may now fail because they were implicitly trusting unreviewed fork code, and that failure exposes secret-exposure patterns maintainers may not have noticed.
3 sources · Jun 23
Timeline Sources Jun 23 The Hacker News
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns
GitHub’s actions/checkout v7 now blocks risky fork PR checkouts in privileged workflows to reduce common pwn request attacks.
original Jun 22 CSO Online
GitHub Actions hardens checkout security to block ‘pwn request’ attacks
After years of trying to educate developers to use pull_request_target securely, the platform finally implements stronger defaults.
original Jun 20 Socket.dev
GitHub Actions Checkout Now Blocks Risky pull_request_target...
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.
original Part of the PlainSec briefing for 2026-06-24
Every edition of this story: GitHub checkout starts failing unsafe PR workflows
More from today