GitHub RCE Vulnerability: CVE-2026-3854 Breakdown(www.wiz.io)
81 pointsby bo0tzz3 hours ago5 comments
  • jcims9 minutes ago
    Anyone in here work at Wiz? Seem like they do pretty good work. Tool itself has survived extreme growth/feature bloat and still does pretty well. Security team has found some really cool stuff.
  • bananapub2 hours ago
    > April 28, 2026

    > GitHub Enterprise Server customers should upgrade immediately - at the time of this writing, our data indicates that 88% of instances are still vulnerable

    > Upgrade to GHES version 3.19.3 or later

    https://docs.github.com/en/enterprise-server@3.19/admin/rele... :

    > Enterprise Server 3.19.3 - March 10, 2026

    88% of on-prem customers haven't applied a critical security fix from 7 weeks ago, that seems ... bad.

    • brianmcnulty41 minutes ago
      I assume a fair amount of these on-prem customers restrict access to their GHES instance to be behind corporate VPN or something similar and are planning a date to upgrade their instance that won't affect operations.

      Any public instance should update immediately though, it's not very hard to put together how to repro the vulnerability on your own from what they provide in the article and the fact that GitHub Enterprise source is publicly available.

    • bombcaran hour ago
      If you're in the enterprise you can update something outside of the normal schedule and guarantee blow up everything (and be blamed) or you can stick with the schedule and hope for the best.

      Guess which is usually picked ...

    • pixl972 hours ago
      Question is how fragile the upgrade process is in large installations. In other enterprise software messing around with large amounts of data I've seen the smallest things break the install and leaving the OPs team rolling back. Was like SharePoint in the past, you were rolling a dice when upgrading it.
      • chucky_zan hour ago
        It's incredibly fragile. It breaks a vast majority of the time and takes multiple rounds of support on-call to upgrade typically.
        • formerly_proven38 minutes ago
          Unsurprising for a fourth tier on-prem created by cutting a continuously deployed application into releases.
  • latchkey3 hours ago
    People keep wanting to replace GitHub, but with what?

    If GH is getting RCE's this late in the game who wants to take the chance something else won't?

    • skrrtwwan hour ago
      A "reasonable" answer is probably a primary self-hosted Forgejo instance as the canonical forge, while using GitHub as a mirror solely to take advantage of its free CI, while that lasts, while hosting secrets with a dedicated secret-hosting provider (I don't know what the provider du jour for this is these days).
      • embedding-shape29 minutes ago
        > solely to take advantage of its free CI, while that lasts

        Eh, if you want to be able to continue working, deploy and what not as normal during weekdays, I'd suggest also moving to Forgejo Actions if you're moving anyways. Not 100% compatible, but more or less the same, and even paying the same but with dedicated hardware you'd get way faster runners.

      • latchkeyan hour ago
        Replace a whole 24/7 team of devops people with myself?

        As much as I'd like to believe that I'm worthy, I'm not.

        • skrrtww42 minutes ago
          If the primary forge's only job is to host the actual Git infrastructure (the code, the MRs, the issues, maybe a wiki), it's a lot more simple than GitHub, and probably more within the scope of what people can reasonably administer themselves.
          • latchkey16 minutes ago
            I hosted the first "java.apache.org". I was an early employee at CollabNet, and in the first discussions around starting subversion. I worked on Cloud Foundry.

            This stuff isn't easy and I'm more than happy letting someone else do it at the expense of some downtime.

    • Caligatioan hour ago
      I am personally now drawing a clear delineation between projects for my internal consumption (e.g. ansible scripts) and projects that have potential use for the general populace. For the prior, I now host a private Forgejo instance. For the latter, I'll put it on GitHub but mirror it to my Forgejo instance.

      I was pleasantly shocked that Forgejo is literally a single binary with a relatively easy config. All my internal services reference my Forgejo instance so, if I need to bail on GitHub, it's low friction for me.

    • gtech1an hour ago
      GitLab ?
    • chucky_zan hour ago
      .... git?

      replace it with git.

      if you want a whole ui you can use something like forgejo which has far fewer features likely leading to less issues.

      • debugnikan hour ago
        You probably meant Forgejo. Codeberg is a Forgejo instance exclusive for FOSS projects.
      • latchkeyan hour ago
        i want what github offers.
        • heliumteraan hour ago
          Enjoy your experience, there will certainly be no end to it.
          • latchkeyan hour ago
            I've had my account since 2008. ¯\_(ツ)_/¯

            updated: changed the date to 2008.

            my account shows 2001, but that's probably from projects I moved over... proof: https://github.com/lookfirst

            • seanclayton29 minutes ago
              Just be careful your patronage doesn't lead to a sunk cost fallacy---a middle manager might just be betting on it
              • latchkey20 minutes ago
                I have no ingrained loyalty, I just haven't found something better.
            • necubian hour ago
              GitHub launched in 2008, so that seems unlikely?
  • WASDx32 minutes ago
    I was impressed enough by AI finding vulnerabilities in source code, but doing it in binary executables is just amazing. This has so much potential, good and bad.

    And yet another lesson to not treat data as instructions. Sanitize all user input!

  • willworktill4pm2 hours ago
    GitHub case will be thought in schools how to screw up almost monopolistic position in the market in couple years. This is beyond bonkers.
    • hnlmorgan hour ago
      Only if they take Skype off the syllabus first.
      • xaxfixho19 minutes ago
        private equity: hold my beer!