GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns

Summary: GitHub is updating actions/checkout so that, effective June 18, 2026, the latest version refuses to fetch fork pull request code in pull_request_target and workflow_run workflows by default, with the change backported to all supported major versions on July 16, 2026. The refusal applies when a pull request comes from a fork and meets certain criteria, unless workflow authors set the allow-unsafe-pr-checkout flag to true.
Why it matters: Pull_request_target runs with the base repository's GITHUB_TOKEN, secrets, and default-branch cache access, and this behavior was weaponized in the s1ngularity campaign against Nx packages and in breaches of PostHog, TanStack, and kubernetes-el; GitHub notes the change only blocks checkouts of the fork pull request head and merge commits, so workflows with secrets, write permissions, deployment permissions, or OIDC publishing access still need review.

Read the original at The Hacker News ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026