Wiz got RCE on the cloud version of Github.com and access to every customer environment.

To do this they just reversed the on prem version and found a simple vuln.

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Beaucoup de gens vont sans doute résumer la faille de sécurité CVE-2026-3854 en « Mon Dieu, la totalité des logiciels hébergés sur GitHub ont peut-être été compromis ».

Mais, en fait, c'était déjà possible, Microsoft (propriétaire de GitHub) pouvait déjà tout modifier.

Tout ce qu'a permis CVE-2026-3854, si des gens l'ont exploité, c'est de démocratiser cette possibilité, en la rendant accessible à tous les gens ayant un compte GitHub.

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

🚨 BREAKING: Wiz Research discovered Remote Code Execution on GitHub.com with a single git push.

Wiz Researchers uncovered a critical flaw in GitHub that could be exploited for RCE. The flaw allowed unauthorized access to millions of repositories belonging to other users and organizations 🤯

We responsibly disclosed the issue to GitHub, who deployed a fix on GitHub.com the same day (!) and released patches for all supported GHES versions.

GitHub Enterprise Server customers are strongly encouraged to update immediately.

Huge kudos to GitHub for addressing the issue 👏

Full technical breakdown here → https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Critical GitHub RCE Vulnerability CVE-2026-3854 Exposed Millions of Repositories to Cross-Tenant Access
#CyberSecurity
https://securebulletin.com/critical-github-rce-vulnerability-cve-2026-3854-exposed-millions-of-repositories-to-cross-tenant-access/

There should be a "but the service is never up to be exploited" reducer on the CVE score.
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

A single git push command was enough to exploit a flaw in #GitHub's internal protocol and achieve code execution on backend infrastructure.

#RemoteCodeExecution

CVE-2026-3854

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Question about the GitHub RCE:

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854 says GHES patches were _released_ on 03/10.

https://github.blog/security/securing-the-git-push-pipeline-responding-to-a-critical-remote-code-execution-vulnerability/ says "we _prepared_ patches [...] and published CVE-2026-3854. These are _available today_".

So were GHES patches made available to customers at the time of CVE publication or only today, 1.5 months laster?

HAHAHAHAHHAHAHAHAHAHAH https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

@GossiTheDog Here's a non-Twitter link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Cette faille GitHub est exploitable par un simple Git Push (CVE-2026-3854) https://www.it-connect.fr/cette-faille-github-est-exploitable-par-un-simple-git-push-cve-2026-3854/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #GitHub

GitHub remote code execution vulnerability found (and patched) https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

RCE in GitHub.com and GitHub Enterprise Server (CVE-2026-3854)

#infosec #github

Somebody stop Wiz 😅

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blog

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Read on HackerWorkspace: https://hackerworkspace.com/article/github-rce-vulnerability-cve-2026-3854-breakdown-wiz-blog

#aisecurity #vulnerability #exploit

Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push https://thehackernews.com/2026/04/researchers-discover-critical-github.html

Wiz whitehats have found an RCE in github (both public github.com and enterprise).
They used AI to reverse-engineer closed source binaries. Take that, security by obfuscation.
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

⚠️ CRITICAL: CVE-2026-3854 lets users with push access run arbitrary code on GitHub backend servers. Impacts GitHub.com & Enterprise Server. GitHub.com patched 2026-03-04; ES patch 2026-03-10. Patch ASAP! No wild exploits found. https://radar.offseq.com/threat/critical-github-vulnerability-exposed-millions-of--29b3abff #OffSeq #GitHub #Infosec

APT28 Exploits Windows 0-Click Flaw CVE-2026-32202 to Steal NTLM Hashes via Defender SmartScreen Bypass
#CyberSecurity
https://securebulletin.com/apt28-exploits-windows-0-click-flaw-cve-2026-32202-to-steal-ntlm-hashes-via-defender-smartscreen-bypass/

🛡️ Title: Windows Shell Spoofing Vulnerability
Description

🛡️ Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

https://www.cve.org/CVERecord?id=CVE-2026-32202

#cybersecurity #security #windows #microsoft

CVE-2026-32202: утечка Net-NTLMv2 через Windows Shell при обработке LNK (zero-click)

Уязвимость в Windows Shell приводит к принудительной аутентификации на удалённый ресурс при разборе LNK/namespace-объектов. Система инициирует SMB-сеанс и отправляет Net-NTLMv2 хеш без действий пользователя. Эксплуатация подтверждена, исправление включено в апрельский пакет обновлений.

https://vk.cc/cXgpgc

#CVE-2026-32202 #Microsoft #WindowsShell #пароли #уязвимость

#infosec #vulnerability #malware

Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202

https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html?m=1

Vols d’identifiants sur Windows : Microsoft révèle l’exploitation de la CVE-2026-32202 https://www.it-connect.fr/vols-didentifiants-sur-windows-microsoft-revele-lexploitation-de-la-cve-2026-32202/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Microsoft #Windows

May I suggest...not exposing your robot control plane to the internet

https://www.resecurity.com/blog/article/cve-2026-25874-hugging-face-lerobot-unauthenticated-rce-via-pickle-deserialization

📰 Critical Unpatched RCE Flaw in Hugging Face's LeRobot AI Platform Puts Robotics Systems at Risk

🚨 CRITICAL FLAW: Unpatched RCE (CVE-2026-25874, CVSS 9.3) in Hugging Face's LeRobot AI platform. Unsafe deserialization allows unauthenticated attackers to execute code. #CVE202625874 #HuggingFace #AI #RCE

🔗 https://cyber.netsecops.io

⚠️ An unpatched critical flaw in Hugging Face’s LeRobot enables remote code execution (CVSS 9.3).

Untrusted pickle over unauthenticated gRPC (no TLS) lets attackers take over servers, steal keys and models, and impact connected robots.

🔗 Details → https://thehackernews.com/2026/04/critical-cve-2026-25874-leaves-hugging.html

The vulnerability in question is CVE-2026-25874 (CVSS score: 9.3), which has been described as a case of untrusted data deserialization stemming from the use of the unsafe pickle format. https://thehackernews.com/2026/04/critical-cve-2026-25874-leaves-hugging.html

Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE

https://thehackernews.com/2026/04/critical-cve-2026-25874-leaves-hugging.html

Read on HackerWorkspace: https://hackerworkspace.com/article/critical-unpatched-flaw-leaves-hugging-face-lerobot-open-to-unauthenticated-rce

#cybersecurity #aisecurity #vulnerability

CVE-2026-42208: Targeted SQL injection against LiteLLM's authentication path discovered 36 hours following vulnerability disclosure | Sysdig

https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure

Read on HackerWorkspace: https://hackerworkspace.com/article/cve-2026-42208-targeted-sql-injection-against-litellm-s-authentication-path-discovered-36-hours-following-vulnerability-disclosure-sysdig

#authentication #aisecurity #vulnerability

RE: https://infosec.exchange/@cR0w/116483262430297764

lol

https://www.cve.org/CVERecord?id=CVE-2026-42615

🔎 XSS (HIGH, CVSS 7.2) in GCHQ CyberChef <11.0.0 (CVE-2026-42615): Improper input neutralization in Show Base64 offsets lets attackers inject scripts remotely — info theft/session hijack possible. No fix yet. Avoid untrusted input. https://radar.offseq.com/threat/cve-2026-42615-cwe-79-improper-neutralization-of-i-760a9adb #OffSeq #CyberChef #XSS

Microsoft Defender “RedSun” Zero-Day (CVE-2026-33825): Unpatched Exploit Grants Full SYSTEM Access
#CyberSecurity
https://securebulletin.com/microsoft-defender-redsun-zero-day-cve-2026-33825-unpatched-exploit-grants-full-system-access/

Article sur une faille sur #PackageKit :

https://goodtech.info/pack2theroot-faille-linux-packagekit-root-cve-2026-41651/

Pour info packagekit est traduit en :
- Kabyle : 31%
- Occitan : 27%
- Breton : 22%

- Basque, Galicien, Catalan : +60%

@kubikpixel Behoben wurde die Schwachstelle bereits Anfang April mit der Veröffentlichung von OpenSSH 10.3

Detail Description :
https://nvd.nist.gov/vuln/detail/CVE-2026-35414
(mW ein weiterhin funktionierender und gemeinnütziger Service der Regierung der United States :awesome: )

New HIGH severity vuln: CVE-2026-42515 impacts CDAC-Noida e-Sushrut HMIS (CVSS 7.1). Authenticated users can bypass auth via manipulated API params — risking patient data. No patch yet. Restrict access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-42515-cwe-639-authorization-bypass-throug-ffcae9ae #OffSeq #Healthcare #CVE #Security

LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure https://thehackernews.com/2026/04/lmdeploy-cve-2026-33626-flaw-exploited.html