Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

GitHub actions/checkout blocks fork pull request checkouts by default in privileged workflows

Security Tool/Service
First reported
Last updated
Happening score
H score 11
1 unique sources, 1 articles

Summary

Hide ▲

GitHub's actions/checkout now refuses common pwn request patterns by default, cutting the risk of attacker-controlled code execution in privileged GitHub Actions workflows. The guardrail applies to forked pull requests in pull_request_target and related workflow_run paths that can expose secrets and GITHUB_TOKEN access. The change began on June 18, 2026 and will be backported to supported major versions on July 16, 2026.

Related Happenings

GitHub npm version 12 hardens installs and token management

Security Tool/Service
H score11 First: 09.07.2026 19:49 Last: 09.07.2026 19:49 Sources 1

About this happening: GitHub released npm version 12, making install-time scripts opt-in by default and tightening package publishing controls to reduce supply-chain risk. The update al...

Open Happening

GitHub npm GAT publish-token mitigation guidance

Advisory/Mitigation
H score25 First: 09.07.2026 19:49 Last: 09.07.2026 19:49 Sources 1

About this happening: GitHub is steering npm users away from long-lived publish tokens as npm GATs that bypass 2FA lose direct publishing and sensitive-management abilities. The recomme...

Open Happening

Workflow-level jailbreak makes GitHub Copilot Chat write harmful answers in code files

Technical Analysis
H score22 First: 08.07.2026 14:21 Last: 08.07.2026 14:21 Sources 1

About this happening: Researchers demonstrated a workflow-level jailbreak against GitHub Copilot Chat that caused harmful answers to be written inside code tasks even when direct chat prompts w...

Open Happening

GitHub Agentic Workflows indirect prompt injection security flaw

Vulnerability
H score27 First: 07.07.2026 17:04 Last: 07.07.2026 17:04 Sources 1

About this happening: GitHub Agentic Workflows has an indirect prompt injection flaw that can let a public issue leak content from private repositories into public comments. The risk is...

Open Happening

Npm v12 default-blocks install scripts, Git dependencies, and remote URLs

Security Tool/Service
H score11 First: 12.06.2026 16:00 Last: 12.06.2026 16:00 Sources 1

About this happening: GitHub announced npm v12 with default-blocking install scripts, Git dependencies, and remote URLs, shifting package installation to explicit opt-in and reducing supp...

Open Happening

Timeline

  1. 23.06.2026 17:22 2 articles · 22d ago

    actions/checkout v7 blocks fork pull request checkouts in privileged workflows

    Mitigation Patch Update

    GitHub's actions/checkout v7 began refusing fork pull request checkouts by default in pull_request_target and certain workflow_run workflows, blocking common pwn request patterns unless workflow authors set allow-unsafe-pr-checkout to true.

    Show sources
    Open in new tab
  2. 23.06.2026 17:22 1 articles · 22d ago

    GitHub announces default refusal of fork pull request code in actions/checkout

    Initial Disclosure

    GitHub announced that actions/checkout is being updated to block pwn request abuse of pull_request_target by refusing fork pull request checkouts that can run attacker-controlled code with the base repository's GITHUB_TOKEN, secrets, and write privileges.

    Show sources
    Open in new tab
  3. 23.06.2026 17:22 1 articles · 22d ago

    GitHub plans July 16 backport of fork pull request checkout refusal

    Mitigation Patch Update

    GitHub expects to backport the same fork pull request checkout refusal in actions/checkout to all currently supported major versions on July 16, 2026, extending the guardrail beyond the latest release.

    Show sources
    Open in new tab