GitHub threat report

GitHub released a security patch for the actions/checkout action that prevents the 'pwn request' vulnerability pattern in GitHub Actions CI/CD workflows. The patch, initially released in actions/checkout v7 on June 18, was backported to versions 2-6 on July 20, 2026. This addresses an attack vector where privileged pull_request_target workflows could execute untrusted fork code. The enforcement activates automatically for floating-tag users; SHA-pinned workflows must upgrade manually.

• GitHub Actions Gets Secure-by-Default CI/CD: Backport Shuts the (opens in a new tab)