Daily Cyber Threat Intelligence โ 22โฏJuneโฏ2026
| Item | Key facts | Practical takeโaways |
|---|---|---|
| GitHub Actions v7 (actions/checkout) | โข Adds automatic block for any workflow that runs on pull_request_target or workflow_run and pulls code from an unreviewed fork. โข Such workflows now fail unless developers add allowโunsafe-pr-checkout. โข Change will be backโported to all major v4โv7 tags on Julyโฏ16; workflows that pin a SHA/patch must upgrade. |
โข Review all actions/checkout usage in PRโtargeted workflows. โข Add the flag only if you really need it. โข Update Dependabot or similar to keep workflows current. |
| Recent โpwn requestโ activity | โข TeamPCP and other actors have abused forkโbased PR workflows to inject malicious code into ~170 npm packages (incl. TanStack Router). โข GitHub itself disclosed a breach exposing ~3,800 internal repos. | โข Inspect forkโbased PR checks; enable branch protection & review apps. โข |
