[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvjfx2QSGdb3f3cdoPkxPip5lnHZ1bwIzKoN5pGG1X-Y":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"fb2fdfe9-8406-424e-b7f7-aec8518ed26e","GitHub Updates actions\u002Fcheckout to Block Common Pwn Request Attack Patterns","github-updates-actions-checkout-to-block-common-pwn-request-attack-patterns-a790ae","GitHub is moving to strengthen software supply chain security by updating \"actions\u002Fcheckout\" to block pwn request attacks that exploit the risky use of the \"pull_request_target workflow\" trigger to run malicious code with the workflow's full privileges. Effective June 18, 2026, the latest version of \"actions\u002Fcheckout,\" the official GitHub action for checking out a repository into the","GitHub is enhancing supply chain security by updating its 'actions\u002Fcheckout' tool to block 'pwn request' attacks. These attacks exploit the 'pull_request_target workflow' trigger to run malicious code with elevated privileges. The update, effective June 18, 2026, will refuse to fetch pull request code from forks by default in specific workflow triggers, preventing attackers from stealing secrets and GITHUB_TOKEN.","GitHub updates actions\u002Fcheckout to block pwn request attacks via pull_request_target.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fgithub-updates-actionscheckout-to-block.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjcacTEKD_LZFda1wwX5aClbAVOb6mwah2lVUY-jUZwNsrSZGDOFL18LP5zYLX3M2DwKng0qknZ5qo_hMk4q-NExgZv1ozhCy7DJuZwvviZE0sv36PQ2k8Y2emv1KMDFplakFwVzulOFPteWkmVoLO6Le912KAbJGFW0nkqKWHEkwJQLbsGhz5npWO3aJaR\u002Fs1600\u002Fgithub-actions.jpg","2026-06-23T14:22:03+00:00","2026-06-23T16:00:24.649599+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"actions\u002Fcheckout","product",{"name":21,"type":22},"GitHub","vendor",{"name":24,"type":25},"s1ngularity","campaign",{"name":27,"type":19},"Nx build system",{"name":29,"type":19},"PostHog",{"name":31,"type":19},"TanStack","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",[],[21,18,27],{"controls":53,"vendors":133},[54,83,111],{"slug":55,"name":56,"problem":57,"products":58},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":84,"name":85,"problem":86,"products":87},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[88,96,103],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":97,"vendor_name":21,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":112,"name":113,"problem":114,"products":115},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[116,124,125],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":97,"vendor_name":21,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[134],{"slug":97,"name":21,"logo_path":98,"roles":135},[136,137],"reported_by","affected",{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":152},"github-patches-pwn-request-flaw-in-actionscheckout-to-protect-cicd-pipelines","GitHub Patches 'Pwn Request' Flaw in actions\u002Fcheckout to Protect CI\u002FCD Pipelines","The 'pwn request' attack exploits the `pull_request_target` workflow trigger, which runs with elevated repository privileges even when the code originates from an untrusted fork — creating a dangerous trust boundary violation in CI\u002FCD pipelines. Attackers can leverage this to execute arbitrary code with access to repository secrets and the GITHUB_TOKEN, effectively compromising the entire software supply chain. This matters because CI\u002FCD pipelines have become high-value targets: a single compromised workflow can lead to secret exfiltration, malicious code injection into builds, or full repository takeover. GitHub's June 2026 update enforces safer defaults, but organizations relying on custom workflows must audit their own configurations proactively rather than waiting for the deadline.",[143,144,145,146,147,148,149,150,151],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 16: Application Software Security","NIST SP 800-204C: CI\u002FCD Pipeline Security Guidance","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 CM-7: Least Functionality","NIST SSDF (SP 800-218) PO.5: Implement and Maintain Secure Environments for Software Development","SLSA Supply Chain Levels for Software Artifacts — Build L2\u002FL3 requirements","OWASP CI\u002FCD Security Top 10: CICD-SEC-4 (Poisoned Pipeline Execution)",{}]