Wire · technology
GitHub Actions Gets Secure-by-Default CI/CD: Backport Shuts the Pwn Request Window
◆ Sectors
◆ Geography
◆ Source
◆ Verified
Fusion42 · 20 July 2026 · Fusion42 review
GitHub deployed a security enforcement that blocks untrusted code from fork pull requests in privileged CI/CD contexts by default across all supported `actions/checkout` versions. The change closes a five-year-old attack vector demonstrated in the AsyncAPI supply chain compromise, which exposed npm publishing tokens and backdoored four packages with 2.25 million weekly downloads.
This Wire brief sits within Fusion42's coverage of Developer Tools and Cybersecurity.
◆ ◆ The Wire takeaway
If you use GitHub Actions with floating tags, your `pull_request_target` workflows are now safe by default—but that doesn't protect the rest of your CI/CD. Audit every other workflow that runs untrusted code with access to secrets or tokens, because GitHub has only closed one door.
◆ Coverage
1 source · 20 Jul 2026
◆ Related on Wire
◆ Topics