News for hackers. Stuff that matters.

A comment on GitHub Actions issued GitHub_TOKEN disclosure in GitHub Actions logs. Parent comment

Re:GitHub Actions issued GitHub_TOKEN disclosure in GitHub A... by semi-extrinsic on Wednesday May 13, 2026 @03:50PM (#48126558)
Not immediately clear to me, is this limited to ghu_xxx type OAUTH tokens? And it's only relevant for PHP projects that use composer in GHA?
[ Parent | on HN ]
Re:GitHub Actions issued GitHub_TOKEN disclosure in GitHub A... by jacobrussell on Wednesday May 13, 2026 @04:00PM (#48126686)
That's my understanding. This seems to only effect PHP projects that use Composer in GitHub actions. Examples being usage of shivammathur/setup-php and or php-actions/composer.
[ Parent | on HN ]
Re:GitHub Actions issued GitHub_TOKEN disclosure in GitHub A... by securesaml on Wednesday May 13, 2026 @05:23PM (#48127798)
It's limited to ghs_ (server to server token's), that have the new format enabled: https://github.blog/changelog/2026-04-24-notice-about-upcomi... (and actions that use the vulnerable package)

This include's the GITHUB_TOKEN that is builtin within a actions jobs.

[ Parent | on HN ]