GitHub Actions Firewall vs. Harden-Runner: Key Security Insights
Article Content
- •GitHub's new egress firewall enhances security for GitHub-hosted Actions runners.
- •Harden-Runner supports Linux, Windows, and macOS, providing broader coverage.
- •Harden-Runner has detected multiple supply chain attacks, proving its effectiveness.
GitHub has introduced a native egress firewall for GitHub-hosted Actions runners, enhancing software supply chain security. However, StepSecurity's Harden-Runner offers broader protection by supporting multiple operating systems and self-hosted environments. Harden-Runner has detected significant supply chain attacks, including compromises of the tj-actions/changed-files and axios npm packages. The new firewall currently supports only GitHub-hosted Linux runners, while Harden-Runner covers Linux, Windows, and macOS across various runner types. This disparity highlights the need for comprehensive security measures in CI/CD environments, which often lack adequate monitoring. The introduction of the firewall raises questions about its effectiveness compared to Harden-Runner's advanced features, such as behavioral detection and network anomaly monitoring.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Sunspot in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What environments does Harden-Runner support?
What attacks has Harden-Runner detected?
How does the new GitHub firewall compare to Harden-Runner?
Continue Reading
China-linked Hackers Exploit PHP2Shell to Compromise 25 Firewalls A China-linked threat actor has exploited vulnerabilities in PHP2Shell (CVE-2026-109618, CVE-2026-109619) and the Fragnesia privilege escalation bug (CVE-2026-46300) to gain root access to 25 firewalls, including those in an U.S. The attackers identified vulnerable systems using the FOFA search engine and executed… 
Brotli Decoder Vulnerability Patched Across Multiple Linux Distributions A vulnerability, CVE-2026-111497, affecting the Brotli decoder has been patched in various Linux distributions, including Fedora 44 and Oracle Linux 10. The flaw allows for an out-of-bounds write, which could potentially enable attackers to execute arbitrary code. The vulnerability was published on October 22, 2026…