GitHub patches critical remote code execution vulnerability in under six hours after AI-assisted discovery
By
Tom Warren
Toasted just enough. A reliable bake, gently seasoned.
Summary
GitHub patched a critical remote code execution vulnerability in under six hours last month. The flaw, discovered by Wiz Research using AI models, targeted GitHub's internal git infrastructure and could have allowed attackers to access millions of public and private code repositories. GitHub's security team reproduced the vulnerability within 40 minutes of receiving the bug bounty report and confirmed its severity. The incident highlights both the power of AI-assisted vulnerability discovery and the importance of rapid incident response in securing critical software infrastructure.
Key quotes
· 3 pulledOur security team immediately began validating the bug bounty report.
Within 40 minutes, we had reproduced the vulnerability internally and confirmed the severity.
This was a critical issue that required immediate action.
You might also wanna read
Critical RCE vulnerability CVE-2026-3854 discovered in GitHub's internal git infrastructure
Wiz Research discovered a critical vulnerability (CVE-2026-3854) in GitHub's internal git infrastructure affecting both GitHub.com and GitHu
wiz.io·1mo ago
GitHub Copilot Vulnerability Enables Remote Code Execution via Prompt Injection
A critical security vulnerability (CVE-2025-53773) in GitHub Copilot allows attackers to achieve remote code execution by placing the AI ass
embracethered.com·7mo ago
GitHub Issue Prompt Injection Leads to 4,000 Developer Machines Compromised via Malicious npm Package
A sophisticated supply chain attack compromised approximately 4,000 developer machines through a GitHub issue title prompt injection. The at
grith.ai·2mo ago
Critical AWS Supply Chain Vulnerability: CodeBreach Allowed Takeover of Key GitHub Repositories
Wiz Research discovered CodeBreach, a critical supply chain vulnerability in AWS that allowed attackers to potentially take over key AWS Git
wiz.io·4mo ago
GitHub Actions workflows identified as common weak link in open source supply chain attacks
This article analyzes a series of high-profile open source supply chain security incidents from the past 18 months, tracing them back to Git
Critical GitHub Copilot Vulnerability Allowed Source Code and Secret Exfiltration
A critical vulnerability (CVSS 9.6) was discovered in GitHub Copilot Chat in June 2025 that allowed attackers to silently exfiltrate secrets
legitsecurity.com·7mo ago