Live data from Hacker News

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

wiz.io

11–20 of 97 posts

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#11
post #8

Earlier quoted context omitted.

.... git? replace it with git. if you want a whole ui you can use something like forgejo which has far fewer features likely leading to less issues.

i want what github offers.

Enjoy your experience, there will certainly be no end to it.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#12

Earlier quoted context omitted.

i want what github offers.

Enjoy your experience, there will certainly be no end to it.

I've had my account since 2008. ¯\_(ツ)_/¯

updated: changed the date to 2008.

my account shows 2001, but that's probably from projects I moved over... proof: https://github.com/lookfirst

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#13

Earlier quoted context omitted.

Enjoy your experience, there will certainly be no end to it.

I've had my account since 2008. ¯\_(ツ)_/¯ updated: changed the date to 2008. my account shows 2001, but that's probably from projects I moved over... proof: https://github.com/lookfirst

GitHub launched in 2008, so that seems unlikely?

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#14
post #8
post #2

People keep wanting to replace GitHub, but with what? If GH is getting RCE's this late in the game who wants to take the chance something else won't?

.... git? replace it with git. if you want a whole ui you can use something like forgejo which has far fewer features likely leading to less issues.

You probably meant Forgejo. Codeberg is a Forgejo instance exclusive for FOSS projects.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#15
post #2

People keep wanting to replace GitHub, but with what? If GH is getting RCE's this late in the game who wants to take the chance something else won't?

I am personally now drawing a clear delineation between projects for my internal consumption (e.g. ansible scripts) and projects that have potential use for the general populace. For the prior, I now host a private Forgejo instance. For the latter, I'll put it on GitHub but mirror it to my Forgejo instance.

I was pleasantly shocked that Forgejo is literally a single binary with a relatively easy config. All my internal services reference my Forgejo instance so, if I need to bail on GitHub, it's low friction for me.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#17
post #2

People keep wanting to replace GitHub, but with what? If GH is getting RCE's this late in the game who wants to take the chance something else won't?

A "reasonable" answer is probably a primary self-hosted Forgejo instance as the canonical forge, while using GitHub as a mirror solely to take advantage of its free CI, while that lasts, while hosting secrets with a dedicated secret-hosting provider (I don't know what the provider du jour for this is these days).

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#18

> April 28, 2026 > GitHub Enterprise Server customers should upgrade immediately - at the time of this writing, our data indicates that 88% of instances are still vulnerable > Upgrade to GHES version 3.19.3 or later https://docs.github.com/en/enterprise-server@3.19/admin/rele... : > Enterprise Server 3.19.3 - March 10, 2026 88% of on-prem customers haven't applied a critical security fix from 7 weeks ago, that seems…

If you're in the enterprise you can update something outside of the normal schedule and guarantee blow up everything (and be blamed) or you can stick with the schedule and hope for the best.

Guess which is usually picked ...

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#19
post #17
post #2

People keep wanting to replace GitHub, but with what? If GH is getting RCE's this late in the game who wants to take the chance something else won't?

A "reasonable" answer is probably a primary self-hosted Forgejo instance as the canonical forge, while using GitHub as a mirror solely to take advantage of its free CI, while that lasts, while hosting secrets with a dedicated secret-hosting provider (I don't know what the provider du jour for this is these days).

Replace a whole 24/7 team of devops people with myself?

As much as I'd like to believe that I'm worthy, I'm not.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#20
post #17

Earlier quoted context omitted.

A "reasonable" answer is probably a primary self-hosted Forgejo instance as the canonical forge, while using GitHub as a mirror solely to take advantage of its free CI, while that lasts, while hosting secrets with a dedicated secret-hosting provider (I don't know what the provider du jour for this is these days).

Replace a whole 24/7 team of devops people with myself? As much as I'd like to believe that I'm worthy, I'm not.

If the primary forge's only job is to host the actual Git infrastructure (the code, the MRs, the issues, maybe a wiki), it's a lot more simple than GitHub, and probably more within the scope of what people can reasonably administer themselves.
Post reply on HN