supply-chain
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns
High
Summary
GitHub is implementing a security update to its "actions/checkout" action to mitigate a common supply chain attack vector. The update, effective June 18, 2026, will block the execution of malicious code from untrusted forks triggered by the "pull_request_target" workflow event, preventing potential access to sensitive information like GitHub tokens and secrets. This change follows recent supply chain attacks targeting popular software packages.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data
