Reverse Engineering With AI Unearths High-Severity GitHub Bug

GitHub yesterday disclosed CVE-2026-3854, a high severity (8.7 CVSS) vulnerability identified in GitHub Enterprise Server that would grant an attacker with push access to a repository to achieve remote code execution. GitHub said in a blog post that the vulnerability also affected github.com, GitHub Enterprise Cloud, GitHub Enterprise Cloud with Data Residency, and GitHub Enterprise Cloud with Enterprise Managed Users. Cloud security firm Wiz reported the vulnerability March 4 through GitHub's bug bounty program. GitHub said that, in less than two hours, it validated the finding, pushed a fix to github.com, and, after an investigation, concluded no exploitation had taken place. While a remote code execution bug generally is worth calling attention to, the circumstances here are particularly noteworthy, as Wiz explained in its blog post. It's "one of the first critical vulnerabilities discovered in closed-source binaries using AI, highlighting a shift in how these flaws are identified." As GitHub's Alexis Wales put it in the company's disclosure blog, user-pushed code in GitHub passes multiple internal services. Metadata, such as repository type and the environment it should be pushed in, is passed between services via an internal protocol. "The vulnerability leveraged how user-supplied git push options were handled within this metadata. Push options are an intentional feature of git that allow clients to send key-value strings to the server during a push," she wrote. "However...