
Security News
CVE Volume Surges Past 48,000 in 2025 as WordPress Plugin Ecosystem Drives Growth
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.


Sarah Gooding
January 5, 2026
If you missed it during the holidays, GitHub Actions pricing went through a brief but explosive cycle of announcement, backlash, and partial reversal. GitHub announced a new per-minute billing change in mid-December, developers pushed back almost immediately, and the company paused the change a day later.
The proposal targeted self-hosted GitHub Actions usage, where teams run CI jobs on their own machines instead of GitHub’s. GitHub Actions is the workflow system itself, while “runners” are the machines that execute those workflows, a distinction that is central to this heated debate.
GitHub still moved forward with price reductions for GitHub-hosted runners, which took effect on January 1. But the proposed billing change for self-hosted Actions was postponed, with questions lingering about how GitHub plans to support teams running their own infrastructure.
The controversy began with GitHub’s mid-December pricing update, which introduced a new $0.002 per-minute “GitHub Actions cloud platform charge.” Under the proposal, that charge would apply to workflows running on self-hosted runners in private repositories starting March 1, 2026.
GitHub emphasized that the fee was not for compute, but for the Actions control plane itself. In its Executive Insights post, the company said that self-hosted runners still rely on GitHub infrastructure for scheduling, orchestration, logs, and workflow management, and that those costs had historically been subsidized by GitHub-hosted runner pricing.
GitHub also pointed to the scale of the platform to justify the change. According to the post, GitHub Actions now runs more than 70 million jobs per day on its new backend architecture and delivered 11.5 billion free Actions minutes on public repositories in 2025 alone.
The pricing update paired the proposed self-hosted billing change with a reduction in GitHub-hosted runner prices, lowering rates by up to 39 percent depending on machine type. GitHub said the new platform charge was already baked into the reduced hosted runner prices.
On paper, GitHub framed the move as a rebalancing of costs across the platform, but the proposed billing changes landed differently with the community.
Reaction on Reddit was swift and blunt. One of the top comments in the discussion summed up the confusion: “Wait what?? When I use self hosted runner and pay for the infra I need to pay M$ as well?”
As teams examined their usage, concern turned into anger. One Reddit user wrote, “Just ran the numbers, and for us, that's close to $3.5k a month extra on our GitHub bill.”
Others pointed out how Actions billing rounds job runtime up to full minutes, which can disproportionately inflate costs for short or frequent jobs. As one commenter put it, “Run for 5 seconds. Billed for 1 minute. Run for 1 minute 1 second. Billed for 2 minutes.”
For teams that had moved to self-hosted runners specifically to control costs or performance, the proposed model felt punitive. Reddit user burlyginger described the change as “orders of magnitude too high,” arguing that GitHub was “charging the same cost of a 1 CPU Linux runner while you run self hosted jobs.”

The frustration was not limited to Reddit. Developers took to nearly every social media outlet to protest the proposed billing changes.
In Hacker News threads, some developers went beyond cost objections to criticize Actions’ reliability. One commenter wrote that self-hosting “doesn’t help all that much with the fragile part” of Actions, and quipped, “Actions is down again, call Brent so he can fix it again,” highlighting a perception that GitHub’s orchestration layer has been unstable compared with other tools.
Other commenters on Hacker News tied the pricing reaction into a wider unease about GitHub’s direction, with some suggesting that reliance on proprietary tools and perceived instability are driving interest in alternatives like GitLab or self-hosted platforms.

Less than a day after the backlash began, GitHub issued a revised update:
“We’ve read your posts and heard your feedback,” the company wrote, announcing that it was postponing the billing change for self-hosted GitHub Actions “to take time to re-evaluate our approach.” At the same time, GitHub confirmed it would still move forward with hosted runner price reductions on January 1.
GitHub acknowledged that it “missed the mark” by not including more customers in its planning and said it would meet with developers, customers, and partners. The company also opened a public discussion thread to collect feedback and said that input would inform the GitHub Actions roadmap.

GitHub reports that the Actions control plane represents a growing operational cost at current scale, even when jobs run entirely on customer-owned hardware. The public discussion thread quickly filled with detailed criticism, much of it focused not on whether GitHub should charge for Actions at all, but on how the proposed model worked.
“We are already paying for the privilege of using the ‘control plane’ by paying for our GitHub accounts,” wrote one commenter. Another, Matthew Ary, contends that per-minute billing fundamentally misrepresents the costs involved, and that the billing unit for self-hosted shouldn't be time based at all.

Several users suggested alternatives, including flat per-job pricing, separate free allowances for self-hosted usage, or billing based on log volume rather than wall-clock time. A recurring theme was that per-minute billing punished slower hardware and experimentation, especially for volunteers, hobbyists, and small teams.
One commenter from a volunteer organization explained that they rely on donated, older machines for self-hosted runners. Under a per-minute model, slower builds would simply cost more to run. “Slower builds directly result in higher costs,” they wrote, calling the proposal backwards.

Among the more detailed responses were examples that went beyond enterprise budgeting or CI efficiency.
One Reddit commenter described working in a research lab at a large university that relies on NIH funding. The lab uses GitHub Actions to build and deploy a desktop application used for genetic analysis, much of it private work that cannot be run in public repositories. To speed up builds and avoid burning through included minutes, the team set up autoscaling self-hosted runners with preinstalled tooling.
Under the proposed pricing model, the commenter said, the additional per-minute charge would likely make that setup unaffordable. “This decision will slow down the pace of development and deployment of important cardiovascular genetics research in this lab,” they wrote, adding that the lab already pays for GitHub out of limited funds and may not be able to migrate away.
That concern echoed elsewhere in the thread, particularly among small teams and volunteer organizations that rely on self-hosted runners not to optimize costs, but to make CI usable at all.
In GitHub’s own feedback thread, several commenters argued that the proposed pricing model penalized teams for choosing more secure or responsible setups.
One commenter, Simon Oakes, said self-hosted runners are essential for those running internal systems that cannot safely be exposed to GitHub-hosted infrastructure:
For anyone running isolated internal services like HashiCorp Vault, S3-compatible storage systems, or other sensitive infrastructure, self-hosted runners aren't optional, they're mandatory. The alternative would be punching massive security holes in your firewall to allow GitHub's infrastructure and potentially millions of users direct access to your internal systems. That's just not a viable option from a security standpoint. Many organisations have architectures where critical automation must use self-hosted runners. We shouldn't be penalised for choosing security over convenience.
As the discussion grew, the pricing debate bled into a broader critique of GitHub Actions itself, with users pointing to years-old issues affecting self-hosted runners, autoscaling, and container parity.
GitHub’s Executive Insights post leaned heavily on promised improvements to the self-hosted experience, including new autoscaling tooling and long-requested runner features. In the feedback thread, those promises were met with skepticism, with users pointing out that many similar commitments had been made before without timely follow-through.
The proposed billing change also rippled through the ecosystem of third-party runner providers, many of which exist to help teams run GitHub Actions on their own infrastructure more efficiently.
One of the clearest articulations of GitHub’s strategy came from Aditya Jayaprakash, CEO of Blacksmith, a third-party GitHub Actions runner service focused on faster, optimized CI execution. In a post titled “The GitHub Actions control plane is no longer free,” Jayaprakash argued that the shift was less about compute pricing and more about monetizing orchestration.
Jayaprakash framed the change in blunt terms:
The new per-minute platform fee changes that. It directly monetizes the Actions control plane and establishes a floor on what GitHub earns from CI, regardless of where jobs run. In effect, self-hosting is no longer free.
At the same time, GitHub reduced the price of GitHub-hosted runners. This isn’t accidental. Lower hosted runner prices make GitHub-hosted runners more attractive, while the platform fee introduces a new, unavoidable cost for self-hosting.
From GitHub’s perspective, this is a rational move. Most Actions usage is concentrated on smaller runners, so the hosted runner price cuts likely don’t materially impact revenue. More importantly, GitHub is trading lower-margin compute revenue for higher-margin platform revenue.
Even among those who accepted that framing, many questioned whether the specific pricing model made sense. Several commenters across other discussions said charging something could be reasonable, but only if GitHub was transparent about costs and delivered a self-hosted experience that felt commensurate with the fee.
GitHub has moved forward with lower prices for GitHub-hosted runners, which took effect on January 1, while pausing the proposed per-minute billing change for self-hosted GitHub Actions. The company says it is gathering feedback and re-evaluating how, or whether, that pricing model should move forward.
The pause has avoided an immediate cost increase for teams running their own infrastructure, but it has not erased the underlying concerns raised by the proposal. Teams are already revisiting cost models, debating alternatives, and reexamining how much control they are comfortable ceding to a single CI platform as GitHub continues to evolve its pricing and product strategy.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now

Security News
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.

Security News
Socket CEO Feross Aboukhadijeh joins Insecure Agents to discuss CVE remediation and why supply chain attacks require a different security approach.

Security News
Tailwind Labs laid off 75% of its engineering team after revenue dropped 80%, as LLMs redirect traffic away from documentation where developers discover paid products.