Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

wiz.io

Post reply on HN
Print view View original

41–50 of 97 posts

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#41

Post by embedding-shape »

skrrtww wrote: post #39
embedding-shape wrote: post #24

Earlier quoted context omitted.

> solely to take advantage of its free CI, while that lasts Eh, if you want to be able to continue working, deploy and what not as normal during weekdays, I'd suggest also moving to Forgejo Actions if you're moving anyways. Not 100% compatible, but more or less the same, and even paying the same but with dedicated hardware you'd get way faster runners.

For companies with resources for infrastructure, sure. For OSS, the unlimited free minutes of multiplatform CI offered by GitHub are literally impossible to replace. Maintaining runners yourself to do the same things would be somewhere between a part- and full-time job.

> For OSS, the unlimited free minutes of multiplatform CI offered by GitHub are literally impossible to replace.

Yeah, how you think the ecosystem got by before GitHub even had actions? Y'all don't remember Travis CI et al anymore?

There are more CI services than what Microsoft offers the world, sometimes it's worth looking around a bit.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#42

Post by latchkey »

capitalhilbilly wrote: post #37
latchkey wrote: post #9

Earlier quoted context omitted.

The people who suggest gitlab, haven't used it. But I guess I could be tempted to try again... https://status.gitlab.com/pages/history/5b36dc6502d06804c083...

If you could only choose from github, gitlab and atlassan then I suppose.. But really anything newer that stays in existance has to be focused on quality from early enough to not be defined by path dependence problems and bad choices like those 3.

Given that github is imploding under a lot of load, everyone leaving github for something else, actually makes github better.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#43

Post by securesaml »

everfrustrated wrote: post #40
semiquaver wrote: post #33

Earlier quoted context omitted.

GHES is essentially unmaintained (perhaps “on life support” would be more charitable since they are certainly accepting payment for it) and has been so for about a decade. It requires a multi-hour downtime to apply even a patch-level release. They do not have any supported mechanism for HA upgrades. So even the most conscientious GHES customers lag the latest version because they can’t afford the downtime. They are c…

Pretty sure GitHub Enterprise Cloud is just Github hosting their enterprise server for you on Azure so you don't have to do the patching yourself.

Github enterprise cloud is on github.com and with more features: http://github.com/account/enterprises/new

They don't host github enterprise server for you (though gitlab has something called gitlab dedicated which they host gitlab ee for you).

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#47

Post by semiquaver »

everfrustrated wrote: post #40
semiquaver wrote: post #33

Earlier quoted context omitted.

GHES is essentially unmaintained (perhaps “on life support” would be more charitable since they are certainly accepting payment for it) and has been so for about a decade. It requires a multi-hour downtime to apply even a patch-level release. They do not have any supported mechanism for HA upgrades. So even the most conscientious GHES customers lag the latest version because they can’t afford the downtime. They are c…

Pretty sure GitHub Enterprise Cloud is just Github hosting their enterprise server for you on Azure so you don't have to do the patching yourself.

It sure isn’t! GitHub Enterprise Cloud is simply an enterprise plan on the regular multitenant github.com. Your repositories are on disk right next to everyone else that uses github.com. There is no segregated storage or compute.

I wish they had a plan to literally host GHES for you because then more people in the company would be forced to reckon with how terrible GHES is from an operational perspective. It is stuck ca. 15-20 years ago conceptually.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#48

Post by Kuinox »

securesaml wrote: post #43
everfrustrated wrote: post #40

Earlier quoted context omitted.

Pretty sure GitHub Enterprise Cloud is just Github hosting their enterprise server for you on Azure so you don't have to do the patching yourself.

Github enterprise cloud is on github.com and with more features: http://github.com/account/enterprises/new They don't host github enterprise server for you (though gitlab has something called gitlab dedicated which they host gitlab ee for you).

Why is there an eu github status then ? https://eu.githubstatus.com/uptime

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#49

Post by crimsonnoodle58 »

latchkey wrote: post #2

People keep wanting to replace GitHub, but with what? If GH is getting RCE's this late in the game who wants to take the chance something else won't?

Self hosted gitlab behind a VPN.

The all-in-docker image and a couple of gitlab runners is all small to medium sized teams need. (Don't overcomplicate it with the kubernetes version unless you really need it)

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#50

Post by sitzkrieg »

latchkey wrote: post #12
heliumtera wrote: post #11

Earlier quoted context omitted.

Enjoy your experience, there will certainly be no end to it.

I've had my account since 2008. ¯\_(ツ)_/¯ updated: changed the date to 2008. my account shows 2001, but that's probably from projects I moved over... proof: https://github.com/lookfirst

i just deleted my account of 2008. github sucks
Post reply on HN