GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

Discussion (28 Comments)Read Original on HackerNews

jcims•about 1 hour ago

Anyone in here work at Wiz? Seem like they do pretty good work. Tool itself has survived extreme growth/feature bloat and still does pretty well. Security team has found some really cool stuff.

bananapub•about 2 hours ago

> April 28, 2026

> GitHub Enterprise Server customers should upgrade immediately - at the time of this writing, our data indicates that 88% of instances are still vulnerable

> Upgrade to GHES version 3.19.3 or later

https://docs.github.com/en/enterprise-server@3.19/admin/rele... :

> Enterprise Server 3.19.3 - March 10, 2026

88% of on-prem customers haven't applied a critical security fix from 7 weeks ago, that seems ... bad.

pixl97•about 2 hours ago

Question is how fragile the upgrade process is in large installations. In other enterprise software messing around with large amounts of data I've seen the smallest things break the install and leaving the OPs team rolling back. Was like SharePoint in the past, you were rolling a dice when upgrading it.

chucky_z•about 2 hours ago

It's incredibly fragile. It breaks a vast majority of the time and takes multiple rounds of support on-call to upgrade typically.

latchkey•about 4 hours ago

People keep wanting to replace GitHub, but with what?

If GH is getting RCE's this late in the game who wants to take the chance something else won't?

chucky_z•about 2 hours ago

.... git?

replace it with git.

if you want a whole ui you can use something like codeberg which has far fewer features likely leading to less issues.

gtech1•about 2 hours ago

GitLab ?

WASDx•about 1 hour ago

I was impressed enough by AI finding vulnerabilities in source code, but doing it in binary executables is just amazing. This has so much potential, good and bad.

And yet another lesson to not treat data as instructions. Sanitize all user input!

willworktill4pm•about 3 hours ago

GitHub case will be thought in schools how to screw up almost monopolistic position in the market in couple years. This is beyond bonkers.

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

⚡ Community Insights

Discussion (28 Comments)Read Original on HackerNews