Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

wiz.io

Post reply on HN
Print view View original

71–80 of 97 posts

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#71

Post by js2 »

semiquaver wrote: post #47
everfrustrated wrote: post #40

Earlier quoted context omitted.

Pretty sure GitHub Enterprise Cloud is just Github hosting their enterprise server for you on Azure so you don't have to do the patching yourself.

It sure isn’t! GitHub Enterprise Cloud is simply an enterprise plan on the regular multitenant github.com. Your repositories are on disk right next to everyone else that uses github.com. There is no segregated storage or compute. I wish they had a plan to literally host GHES for you because then more people in the company would be forced to reckon with how terrible GHES is from an operational perspective. It is stuck…

[flagged]

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#72

Post by skrrtww »

esseph wrote: post #63
skrrtww wrote: post #39

Earlier quoted context omitted.

For companies with resources for infrastructure, sure. For OSS, the unlimited free minutes of multiplatform CI offered by GitHub are literally impossible to replace. Maintaining runners yourself to do the same things would be somewhere between a part- and full-time job.

> https://docs.codeberg.org/ci/ "Codeberg is a non-profit, community-led effort that provides services to free and open-source projects, such as Git hosting (using Forgejo), Pages, CI/CD and a Weblate instance." Never say impossible. Github is still "new" to a lot of us. OSS existed well before it, and will continue to exist well after.

If Codeberg starts offering Mac and Windows runners alongside their Linux ones for free (or at an achievable price point) for a modest OSS project I'll certainly look at it very closely. If all I needed was a Linux runner, I'd probably be on there already.

And yes, if we make OSS just about hosting the code, things are much simpler. If you're a piece of desktop software though, and you have users, they'll typically (and reasonably) want auditable signed binaries on all the platforms you support, which requires multiplatform CI.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#73

Post by rnhmjoj »

latchkey wrote: post #19
skrrtww wrote: post #17

Earlier quoted context omitted.

A "reasonable" answer is probably a primary self-hosted Forgejo instance as the canonical forge, while using GitHub as a mirror solely to take advantage of its free CI, while that lasts, while hosting secrets with a dedicated secret-hosting provider (I don't know what the provider du jour for this is these days).

Replace a whole 24/7 team of devops people with myself? As much as I'd like to believe that I'm worthy, I'm not.

It's the devops team can manage a measly 87% uptime [1] you're talking about, you can do a lot better on your homeserver.

[1]: https://mrshu.github.io/github-statuses/

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#74

Post by eyegor »

technion wrote: post #66
bananapub wrote: post #4

> April 28, 2026 > GitHub Enterprise Server customers should upgrade immediately - at the time of this writing, our data indicates that 88% of instances are still vulnerable > Upgrade to GHES version 3.19.3 or later https://docs.github.com/en/enterprise-server@3.19/admin/rele... : > Enterprise Server 3.19.3 - March 10, 2026 88% of on-prem customers haven't applied a critical security fix from 7 weeks ago, that seems…

I guess I woukd say youre fortunate to have not worked in a "we cannot use github.com because we take security very seriously" environment. Because always tells me you'll be running a on prem product that might get updated once a year.

On prem beats the heck out of github post Microsoft though... At least you know how to get it working again when someone breaks it. These days with github you expect a weekly 500, a rainbow unicorn error, build failures due to unavailable errors, etc. Last I checked the third party tracker github services were barely pushing one 9 of reliability.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#76

Post by jamesfinlayson »

fastest963 wrote: post #70
jamesfinlayson wrote: post #61

Earlier quoted context omitted.

For sure - the last company I worked at that had GitHub Enterprise had it running on a private network only accessible within the company.

Yeah, but this still gives any employee RCE on the GHES server right?

I suppose so. The company invested pretty heavily in security tooling, though I think it wouldn't have been hard to do something to bypass the security for internal servers.

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#77

Post by jospeh554 »

jcims wrote: post #29

Anyone in here work at Wiz? Seem like they do pretty good work. Tool itself has survived extreme growth/feature bloat and still does pretty well. Security team has found some really cool stuff.

I'm not there, but we use it at our place. It triggers on entirely innocent things I do.

And yet when I do something a bit dodgy (like query a DC with a cli, and reset credentials) it's silent...

Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

#80

Post by himata4113 »

gtech1 wrote: post #6
latchkey wrote: post #2

People keep wanting to replace GitHub, but with what? If GH is getting RCE's this late in the game who wants to take the chance something else won't?

GitLab ?

Me and my friends call it CveLab because there was a time where there was a critical security update every week or multiple times a week.
Post reply on HN