GitHub fixed a critical flaw allowing attackers to hijack millions of repositories via a single git push command, but most enterprise servers remain unpatched.

GitHub patched critical RCE flaw CVE-2026-3854 in hours, preventing potential repo takeover and enterprise server compromise.

GitHub has patched a high-severity remote code execution vulnerability that allowed anyone with push access to a private ...

In GitHub and GitHub Enterprise Server, attackers with push rights to repositories can inject malicious code. Updates fix this.