https://www.cloudkaramchari.com/tags/supply-chain-security/Recent content in Supply Chain Security on CloudkaramchariHugo -- gohugo.ioencloudkaramchariMon, 13 Jul 2026 18:00:00 +0530https://www.cloudkaramchari.com/blog/fix-pwn-request-vulnerability-github-actions-checkout-v7/Mon, 13 Jul 2026 18:00:00 +0530https://www.cloudkaramchari.com/blog/fix-pwn-request-vulnerability-github-actions-checkout-v7/ <h1 id="github-actions-checkout-v7-fixing-the-pwn-request-vulnerability-before-july-16">GitHub Actions Checkout v7: Fixing the Pwn Request Vulnerability Before July 16</h1> <p>If your CI pipeline uses <code>pull_request_target</code> and checks out the pull request's head commit, <code>actions/checkout@v7</code> will now refuse to do it. That's not a bug — it's GitHub closing one of the most common CI/CD attack patterns in the ecosystem, known as a &quot;pwn request.&quot; The change shipped June 18, 2026, and on <strong>July 16, 2026</strong> the same enforcement gets backported to every currently supported major version of the action (v3 through v6), so pinning to an older tag won't save you for long.</p>