EpiFive
Daily IT & AI brief

IT & AI brief, 4 November 2026: GitHub blocks pull_request_target, WordPress added to KEV

GitHub Actions will block pull_request_target by default in public repos from 2 December with brownouts on 9 and 16 November, CISA added WordPress Core to KEV, and the Outlook usage report leaves the EAC.

By EpiFive Editorial TeamHow the brief is made

GitHub will block the pull_request_target workflow event by default in public repositories from 2 December, with two brownout windows in November that will actually fail runs. CISA also added a WordPress Core flaw to its exploited-vulnerabilities list with a three-day deadline.

GitHub Actions: pull_request_target blocked by default, brownouts on 9 and 16 November

What changed: GitHub says pull_request_target workflows will be blocked by default in public repositories from 2 December 2026, unless an Actions event policy explicitly allows them. The reason is that this event runs with the base repository's context and secrets, so code from an untrusted fork can reach them. Enforcement was earlier planned for 2 November. The rule starts in evaluate mode, which reports what would be blocked. Brownouts run 16:00-18:00 UTC on 9 and 16 November, when affected runs fail with an error annotation.

Who is affected: Public repositories on GitHub Free, Team and Enterprise Cloud. Private and internal repositories and GitHub Enterprise Server are not affected.

What to do: Before 9 November, use Insights to find runs the rule would block. Then either accept the block or add an allow rule in an Actions event policy, scoped to specific workflow files. Details are in the GitHub changelog.

CISA adds WordPress Core to the KEV catalog

What changed: On 3 November CISA added CVE-2026-119977 in WordPress Core to the Known Exploited Vulnerabilities catalog, with a due date of 6 November. The catalog entry is the primary source; this brief does not describe the flaw beyond that. Several other entries have deadlines soon: Google Brotli (CVE-2026-111497) and Adobe Commerce and Magento (CVE-2026-48356) on 10 November, Broadcom VMware ESX (CVE-2026-41709) on 11 November, and the second Ivanti Connect Secure flaw (CVE-2026-118527) on 13 November.

Who is affected: Anyone running WordPress sites, including small businesses with agency-managed sites, plus teams running the other listed products.

What to do: Check the WordPress version on every site you own, apply the latest available core update, and confirm auto-updates are on. Review the other deadlines against your inventory, especially ESX hosts.

Outlook for Windows usage report leaves the Exchange admin center

What changed: Microsoft moved the retirement of the Outlook for Windows usage report in the Exchange admin center to early-to-late November 2026, from the earlier August to September window. The retirement is automatic with no admin toggle, and Outlook itself is unaffected. See MC1230889.

Who is affected: Admins who use that report for Outlook adoption or version tracking.

What to do: No action is required. Switch any saved process to Reports > Usage > M365 Apps > Usage > Outlook for Windows in the Microsoft 365 admin center, and update runbooks that point at the EAC report.

Amazon RDS for SQL Server adds new CU and GDR builds

What changed: On 3 November AWS added the latest updates for RDS for SQL Server: 2017 CU31 plus GDR (KB5128496), 2019 CU32 plus GDR (KB5128494), 2022 CU27 plus GDR (KB5126934) and 2025 CU10 (KB5125471). Fixes are listed in the Microsoft KB articles. Source: AWS What's New.

Who is affected: Anyone running RDS for SQL Server on these versions.

What to do: Read the KB notes, test the upgrade on a restored copy of a non-production instance, then schedule it for the maintenance window using the console, CLI or SDK.

AWS Config records ten more resource types

What changed: AWS Config now supports ten new resource types, including ElastiCache cache clusters and replication groups, Billing views, QuickSight agents and Connect hours of operation. If you record all resource types they are tracked automatically and work with Config rules and aggregators. See AWS What's New.

Who is affected: Teams that use Config for inventory or compliance, particularly those with selective recording.

What to do: If you record selected types only, add the ones you use. Expect more configuration items, which can affect Config costs.

GitHub Desktop can use short-lived tokens

What changed: GitHub Desktop 3.6.10 and later can issue short-lived authentication tokens that refresh automatically, for eligible github.com accounts including Enterprise Cloud, rolling out gradually. GitHub Enterprise Server is not included. See the GitHub changelog.

Who is affected: Developers using GitHub Desktop.

What to do: No action needed. Existing sessions stay signed in; tokens are issued when users update and sign in again.

Also worth knowing