{"id":416518,"date":"2026-04-29T11:17:09","date_gmt":"2026-04-29T11:17:09","guid":{"rendered":"https:\/\/www.newsbeep.com\/il\/416518\/"},"modified":"2026-04-29T11:17:09","modified_gmt":"2026-04-29T11:17:09","slug":"github-rushed-to-fix-a-critical-vulnerability-in-less-than-six-hours","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/il\/416518\/","title":{"rendered":"GitHub rushed to fix a critical vulnerability in less than six hours"},"content":{"rendered":"

GitHub employees fixed a critical remote code execution vulnerability in less than six hours last month. Wiz Research used<\/a> AI models to uncover a vulnerability in GitHub\u2019s internal git infrastructure that could have allowed attackers to access millions of public and private code repositories.<\/p>\n

\u201cOur security team immediately began validating the bug bounty report. Within 40 minutes, we had reproduced the vulnerability internally and confirmed the severity,\u201d explains Alexis Wales<\/a>, GitHub chief information security officer. \u201cThis was a critical issue that required immediate action.\u201d<\/p>\n

GitHub\u2019s engineering team developed a fix and deployed it just over an hour after identifying the root cause, protecting both GitHub.com and GitHub Enterprise Server. \u201cIn less than two hours we had validated the finding, deployed a fix to github.com, and begun a forensic investigation that concluded there was no exploitation,\u201d says Wales. This meant the issue was fixed within six hours of the report from Wiz.<\/p>\n

The vulnerability itself was discovered \u201cusing AI,\u201d according to Wiz. It\u2019s not clear exactly what AI model helped find the issue, though. \u201cNotably, this is one of the first critical vulnerabilities discovered in closed-source binaries using AI, highlighting a shift in how these flaws are identified,\u201d says Sagi Tzadik, a security researcher at Wiz.<\/p>\n

While GitHub\u2019s rapid response meant a fix was deployed in just hours, Wiz warns that the rare vulnerability was \u201cremarkably easy to exploit,\u201d despite how complex GitHub\u2019s underlying system is. \u201cA finding of this caliber and severity is rare, earning one of the highest rewards available in our Bug Bounty program, and serves as a reminder that the most impactful security research comes from skilled researchers who know how to ask the right questions,\u201d says Wales.<\/p>\n

The discovery of a major vulnerability in GitHub comes just days after GitHub had a major outage<\/a> that randomly reverted previously merged commits (code snapshots) for some users. GitHub also had other outages<\/a> last week, in what\u2019s increasingly becoming a trend for the service. I reported last week<\/a> on employee concerns about GitHub reliability, highlighting one GitHub employee who says \u201cthe company is collapsing, both in outages that are reallllly bad and have torched the company reputation\u2026 and in an exodus of leadership.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"GitHub employees fixed a critical remote code execution vulnerability in less than six hours last month. Wiz Research…\n","protected":false},"author":2,"featured_media":416519,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[345,85,46,134,43,140,920,125],"class_list":["post-416518","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-ai","tag-il","tag-israel","tag-microsoft","tag-news","tag-security","tag-tech","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/416518","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/comments?post=416518"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/416518\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media\/416519"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media?parent=416518"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/categories?post=416518"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/tags?post=416518"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}