GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns

GitHub is moving to strengthen software supply chain security by updating "actions/checkout" to block pwn request attacks that exploit the risky use of the "pull_request_target workflow" trigger to run malicious code with the workflow's full privileges. Effective June 18, 2026, the latest version of "actions/checkout," the official GitHub action for checking out a repository into the

The report says GitHub has updated actions/checkout to block common “pwn request” patterns, especially unsafe use of pull_request_target and related workflow_run setups that can execute attacker-controlled code with elevated repository privileges. It also notes the protection applies to actions/checkout and is available in v7, with backports to supported major versions planned. CyberSE.AI would classify this as an AI supply chain risk because it affects the integrity of CI/CD and dependency execution paths that AI-enabled development and deployment pipelines may rely on; organizations should review workflow triggers, checkout patterns, and action pinning to reduce privileged code-execution exposure.