Tag: github
-
Max-severity RCE flaw found in Google Gemini CLI
The behavior is now fixed: Google has addressed the issue by removing implicit workspace trust in headless environments and enforcing stricter tool controls, effectively changing how Gemini CLI behaves in CI/CD pipelines.The patched versions (0.39.1 and 0.40.0-preview.3) now require explicit trust decisions before loading workspace configurations, aligning non-interactive execution with the same safeguards expected in…
-
Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution
Google has addressed a maximum severity security flaw in Gemini CLI — the “@google/gemini-cli” npm package and the “google-github-actions/run-gemini-cli” GitHub Actions workflow — that could have allowed attackers to execute arbitrary commands on host systems.”The vulnerability allowed an unprivileged external attacker to force their own malicious content to load as Gemini configuration,” First seen on…
-
Warp open sources its AI terminal client
Warp, the AI-centric terminal used by close to a million developers, has released the source code for its client on GitHub under the AGPL license, with OpenAI signed on as the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/30/warp-open-source-client/
-
Warp open sources its AI terminal client
Warp, the AI-centric terminal used by close to a million developers, has released the source code for its client on GitHub under the AGPL license, with OpenAI signed on as the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/30/warp-open-source-client/
-
Warp open sources its AI terminal client
Warp, the AI-centric terminal used by close to a million developers, has released the source code for its client on GitHub under the AGPL license, with OpenAI signed on as the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/30/warp-open-source-client/
-
Warp open sources its AI terminal client
Warp, the AI-centric terminal used by close to a million developers, has released the source code for its client on GitHub under the AGPL license, with OpenAI signed on as the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/30/warp-open-source-client/
-
Warp open sources its AI terminal client
Warp, the AI-centric terminal used by close to a million developers, has released the source code for its client on GitHub under the AGPL license, with OpenAI signed on as the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/30/warp-open-source-client/
-
Reverse Engineering With AI Unearths High-Severity GitHub Bug
Wiz used an AI reverse-engineering tool to pinpoint a vulnerability that previously would have been too costly and time-consuming to undertake. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/reverse-engineering-ai-unearths-high-severity-github-bug
-
Zounds, a genuinely helpful AI-assisted bug report that isn’t total slop! Here, Wiz, take this wad of cash
Claude ploughs through months of work in rapid time, helps Wiz researchers nab lucrative award First seen on theregister.com Jump to article: www.theregister.com/2026/04/29/github_woah_a_genuinely_helpful/
-
Zounds, a genuinely helpful AI-assisted bug report that isn’t total slop! Here, Wiz, take this wad of cash
Claude ploughs through months of work in rapid time, helps Wiz researchers nab lucrative award First seen on theregister.com Jump to article: www.theregister.com/2026/04/29/github_woah_a_genuinely_helpful/
-
GitHub Flaw Enables Remote Code Execution With a Single Git Push
A GitHub flaw (CVE-2026-3854) enabled backend code execution via a single git push, risking exposure of repositories and secrets. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/github-flaw-enables-remote-code-execution-with-a-single-git-push/
-
GitHub Flaw Enables Remote Code Execution With a Single Git Push
A GitHub flaw (CVE-2026-3854) enabled backend code execution via a single git push, risking exposure of repositories and secrets. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/github-flaw-enables-remote-code-execution-with-a-single-git-push/
-
GitHub Flaw Enables Remote Code Execution With a Single Git Push
A GitHub flaw (CVE-2026-3854) enabled backend code execution via a single git push, risking exposure of repositories and secrets. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/github-flaw-enables-remote-code-execution-with-a-single-git-push/
-
A Mini Shai-Hulud Targeting the SAP Ecosystem
7 stolen GitHub tokens. 971 repositories. A self-replicating supply chain attack targeting SAP’s Node.js packages, and it’s still active. Here’s what GitGuardian found. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/a-mini-shai-hulud-targeting-the-sap-ecosystem/
-
A Mini Shai-Hulud Targeting the SAP Ecosystem
7 stolen GitHub tokens. 971 repositories. A self-replicating supply chain attack targeting SAP’s Node.js packages, and it’s still active. Here’s what GitGuardian found. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/a-mini-shai-hulud-targeting-the-sap-ecosystem/
-
88% of self-hosted GitHub servers exposed to RCE, researchers warn (CVE-2026-3854)
When researchers at Wiz reported an easily exploitable GitHub remote code execution flaw (CVE-2026-3854) on March 4, the company confirmed it within 40 minutes and pushed a … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/29/cve-2026-3854-github-rce-vulnerability/
-
Woah, a genuinely helpful AI-assisted bug report that isn’t total slop. Here, Wiz, take this wad of cash
Claude ploughs through months of work in rapid time, helps Wiz researchers nab lucrative award First seen on theregister.com Jump to article: www.theregister.com/2026/04/29/github_woah_a_genuinely_helpful/
-
Hashicorp co-founder Mitchell Hashimoto says GitHub ‘no longer a place for serious work’
Tags: githubBemoans frequent outages that mean he’ll move Ghostty elsewhere First seen on theregister.com Jump to article: www.theregister.com/2026/04/29/mitchell_hashimoto_ghostty_quitting_github/
-
Hashicorp co-founder Mitchell Hashimoto says GitHub ‘no longer a place for serious work’
Tags: githubBemoans frequent outages that mean he’ll move Ghostty elsewhere First seen on theregister.com Jump to article: www.theregister.com/2026/04/29/mitchell_hashimoto_ghostty_quitting_github/
-
Visual Studio cloud agents now run inside GitHub Copilot
Microsoft’s April update to Visual Studio introduces cloud agent integration in GitHub Copilot, enabling developers to offload tasks to remote infrastructure for scalable, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/29/microsoft-visual-studio-cloud-agent-integration/
-
GitHub fixes RCE flaw that gave access to millions of private repos
In early March, GitHub patched a critical remote code execution vulnerability (CVE-2026-3854) that could have allowed attackers to access millions of private repositories. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/github-fixes-rce-flaw-that-gave-access-to-millions-of-private-repos/
-
GitHub fixes RCE flaw that gave access to millions of private repos
In early March, GitHub patched a critical remote code execution vulnerability (CVE-2026-3854) that could have allowed attackers to access millions of private repositories. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/github-fixes-rce-flaw-that-gave-access-to-millions-of-private-repos/
-
GitHub fixes RCE flaw that gave access to millions of private repos
In early March, GitHub patched a critical remote code execution vulnerability (CVE-2026-3854) that could have allowed attackers to access millions of private repositories. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/github-fixes-rce-flaw-that-gave-access-to-millions-of-private-repos/
-
GitHub fixes RCE flaw that gave access to millions of private repos
In early March, GitHub patched a critical remote code execution vulnerability (CVE-2026-3854) that could have allowed attackers to access millions of private repositories. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/github-fixes-rce-flaw-that-gave-access-to-millions-of-private-repos/
-
Woah, a genuinely helpful AI-assisted bug report that isn’t total slop. Here, Wiz, take this wad of cash
Claude ploughs through months of work in rapid time, helps Wiz researchers nab lucrative award First seen on theregister.com Jump to article: www.theregister.com/2026/04/29/github_woah_a_genuinely_helpful/
-
Critical GitHub RCE bug exposed millions of repositories
Full compromise across tenants: In its analysis, Wiz detailed how the issue could be escalated from initial command execution to full remote code execution on affected systems.”On GitHub.com, this vulnerability allowed remote code execution on shared storage nodes. We confirmed that millions of public and private repositories belonging to other users and organizations were accessible…
-
Critical GitHub RCE bug exposed millions of repositories
Full compromise across tenants: In its analysis, Wiz detailed how the issue could be escalated from initial command execution to full remote code execution on affected systems.”On GitHub.com, this vulnerability allowed remote code execution on shared storage nodes. We confirmed that millions of public and private repositories belonging to other users and organizations were accessible…
-
GitHub Fixes Critical RCE Bug CVE-2026-3854 Within Hours of Discovery
Tags: cloud, cve, cvss, cybersecurity, flaw, github, infrastructure, rce, remote-code-execution, vulnerabilityCybersecurity researchers have revealed critical details about a newly identified RCE vulnerability, tracked as CVE-2026-3854, affecting both GitHub’s cloud infrastructure and GitHub Enterprise Server deployments. The flaw, which carries a high CVSS score of 8.7, could allow an authenticated user to execute arbitrary code on affected systems with a single crafted First seen on thecyberexpress.com…
-
Per Git-Push-Befehl: Angreifer hätten Millionen von Github-Repos kapern können
Git-Push-Befehle gehören für viele Entwickler zum Alltag. Nur einer davon hätte gereicht, um tief in die Infrastruktur von Github einzudringen. First seen on golem.de Jump to article: www.golem.de/news/per-git-push-befehl-angreifer-haetten-millionen-von-github-repos-kapern-koennen-2604-208133.html
-
GitHub.com and Enterprise Server Vulnerability Allows Remote Code Execution
Wiz Research has identified a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-3854, deeply embedded within GitHub’s internal git infrastructure. This high-severity flaw enabled any authenticated user to execute arbitrary commands on backend servers using a single standard git push command. The vulnerability originates from an improper neutralization of special elements during repository push operations. GitHub’s…