PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854)

wiz.io | vulnerability | CVE-2026-3854 | #rce | #vulnerability-research | #github | #enterprise-security | #cve-2026-3854 | #wiz-research
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2026-3854: a Wiz-discovered injection flaw let any authenticated user get RCE on GitHub's shared storage nodes via one git push; fixed within hours, but 88% of GHES instances stayed vulnerable.
CVE
CVE-2026-3854
Published
Collected

Related coverage

research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
Critical · vulnerability · github.com
php2shell (CVE-2026-109618 / CVE-2026-109619): PHP Pre-Auth RCE PoC, Source Patch & Comprehensive Defense Guide
Provides critical stopgap mitigations, source-level patches, and multi-web-server WAF rules for teams securing PHP deployments, especially for unpatched legacy and end-of-life installations.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
research · wiz.io
Exposure Report: 65% of Leading AI Companies Found with Verified Secret Leaks
Wiz scanned the Forbes AI 50 and found 65% of leading private AI companies had verified secret leaks on GitHub — API keys and tokens buried in deleted forks and gists that standard scanners miss.
tool · github.com
node2shell-scanner: High-Fidelity Remote Detection Tool for Node.js Brotli OOB Write (CVE-2026-111497)
Provides defenders and security teams with a safe, non-destructive, and high-fidelity method to scan large attack surfaces and confirm Node.js exposure to the critical Brotli decoder flaw.
Back