GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

The big headline is scary enough: researchers at Wiz found a critical security hole in GitHub’s code-handling system that could let a logged-in user run commands on GitHub’s own machines with a single code upload. GitHub says its main website was fixed within six hours, but the real gasp from the crowd came from one stat: 88% of GitHub Enterprise Server customers were still vulnerable at the time of writing. That’s the self-hosted version companies run themselves, and commenters reacted like they’d just watched someone ignore a blaring fire alarm for weeks.

The comment section instantly split into two camps: “How did this happen?” and “Wow, Wiz is terrifyingly good.” One incredulous reader zeroed in on the design itself, basically saying: hold on, users could sneak their own text into a security-sensitive internal message and nobody thought that might go badly? The vibe was less polite review, more full-body “wtf”. Meanwhile, others were fascinated by the claim that AI helped find the flaw, calling it a sign that chatty code-reading bots are becoming real power tools for modern security hunters.

And then came the side-eye. One commenter did the calendar math and pointed out the patch had already been out since March, turning the thread into a mini roast of slow-moving corporate IT teams. Another asked if anyone at Wiz was hiring, which is probably the nerdiest possible way to say, “Okay, I’m impressed.”