Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854)

wiz.io | vulnerability | CVE-2026-3854 | #rce | #vulnerability-research | #github | #enterprise-security | #cve-2026-3854 | #wiz-research

Summary

CVE-2026-3854: a Wiz-discovered injection flaw let any authenticated user get RCE on GitHub's shared storage nodes via one git push; fixed within hours, but 88% of GHES instances stayed vulnerable.
Published
Collected

original ↗

Related coverage

  1. Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets (wiz.io)
  2. Exposure Report: 65% of Leading AI Companies Found with Verified Secret Leaks (wiz.io)
  3. Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase (hackerone.com)
  4. Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise (wiz.io)
  5. RediShell: Critical Remote Code Execution Vulnerability (CVE-2025-49844) in Redis, 10 CVSS score (wiz.io)
  6. Breaking NVIDIA Triton: CVE-2025-23319 - A Vulnerability Chain Leading to AI Server Takeover (wiz.io)

back