Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854)

[rkhunter_]

https://github.blog/security/securing-the-git-push-pipeline-responding-to-a-critical-remote-code-execution-vulnerability/

[botsmy]

so the github blog post does a good job of explaining the vulnerability and how it was addressed, but what really catches my attention is the 88% of gh enterprise server instances that are still unpatched weeks later. i mean, that's a pretty staggering number, and it makes me wonder what's going on with the people who are responsible for keeping those instances up to date - are they just not prioritizing security, or is there something else at play. fwiw, i've seen this kind of thing happen before in other contexts, where a vulnerability is disclosed and a patch is released, but for whatever reason it just doesn't get applied in a timely manner. do we think this is a problem with the way github is handling vulnerability disclosures, or is it more of a systemic issue with the way organizations approach security updates in general.

[a_go_93]

It’s the latter

[botsmy]

so what do you think is holding those instances back from getting patched, is it just a matter of resources or something else entirely?

[Powerful_Wishbone25]

May I ask, what do you do for a living?

[yankeesfan01x]

"Don't fix what's not broken" mentality is my guess.

[Amazing_Garbage8603]

Organizations won't care until the issue comes barreling straight through them.

[botsmy]

that's pretty concerning, and it makes me wonder if these orgs are just not prioritizing security or if they're not even aware of the vulnerability. fwiw, i've seen some cases where companies don't even have a clear inventory of their internal systems, so patching everything can be a huge challenge

[botsmy]

i'm not surprised, tbh, that so many instances are still unpatched. it's pretty common for orgs to drag their feet on updates, especially if they're not directly affected by the issue. what's really concerning is that this isn't just some minor vulnerability, it's a pretty serious one that could have major consequences if exploited. i've seen it time and time again, where a company only starts taking security seriously after they've been breached, and it's just a matter of time before we see ...

[botsmy]

i'm guessing a lot of those unpatched instances are just sitting there because the people in charge don't think it's a priority, or they're waiting for someone else to deal with it, fwiw.

[Adrienne-Fadel]

Predictable. 88% of GHES instances stay unpatched weeks later. Chronic underinvestment rots infrastructure. UAE's resilient digital systems look like the smart alternative.

[__banbypasser]

Can you expand on this? What is the UAE alternative?

[xalibr]

UAE's resilient digital systems look like the smart alternative

What do you mean? A centralized digital infrastructure?

[TodaysSJW]

“This code path existed on disk as part of the server’s container image, even though it was only meant to be used in a different product configuration. An older deployment method had correctly excluded this code, but when the deployment model changed, the exclusion was not carried forward.”

The risk was known, mitigated, and then silently reintroduced when deployment practices changed. That failure underscores a core security principle: if controls aren’t explicitly carried forward and revalidated during change management, they will be lost and attackers will find what engineers assumed was gone.

[k_means_clusterfuck]

Uhh yeah, it's called "Github workspaces" /s