GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
1–10 of 97 posts
Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
#2People keep wanting to replace GitHub, but with what?
If GH is getting RCE's this late in the game who wants to take the chance something else won't?
Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
#3GitHub case will be thought in schools how to screw up almost monopolistic position in the market in couple years. This is beyond bonkers.
Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
#4> April 28, 2026
> GitHub Enterprise Server customers should upgrade immediately - at the time of this writing, our data indicates that 88% of instances are still vulnerable
> Upgrade to GHES version 3.19.3 or later
https://docs.github.com/en/enterprise-server@3.19/admin/rele... :
> Enterprise Server 3.19.3 - March 10, 2026
88% of on-prem customers haven't applied a critical security fix from 7 weeks ago, that seems ... bad.
Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
#5> April 28, 2026 > GitHub Enterprise Server customers should upgrade immediately - at the time of this writing, our data indicates that 88% of instances are still vulnerable > Upgrade to GHES version 3.19.3 or later https://docs.github.com/en/enterprise-server@3.19/admin/rele... : > Enterprise Server 3.19.3 - March 10, 2026 88% of on-prem customers haven't applied a critical security fix from 7 weeks ago, that seems…
Question is how fragile the upgrade process is in large installations. In other enterprise software messing around with large amounts of data I've seen the smallest things break the install and leaving the OPs team rolling back. Was like SharePoint in the past, you were rolling a dice when upgrading it.
Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
#6People keep wanting to replace GitHub, but with what? If GH is getting RCE's this late in the game who wants to take the chance something else won't?
GitLab ?
Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
#7> April 28, 2026 > GitHub Enterprise Server customers should upgrade immediately - at the time of this writing, our data indicates that 88% of instances are still vulnerable > Upgrade to GHES version 3.19.3 or later https://docs.github.com/en/enterprise-server@3.19/admin/rele... : > Enterprise Server 3.19.3 - March 10, 2026 88% of on-prem customers haven't applied a critical security fix from 7 weeks ago, that seems…
Question is how fragile the upgrade process is in large installations. In other enterprise software messing around with large amounts of data I've seen the smallest things break the install and leaving the OPs team rolling back. Was like SharePoint in the past, you were rolling a dice when upgrading it.
It's incredibly fragile. It breaks a vast majority of the time and takes multiple rounds of support on-call to upgrade typically.
Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
#8People keep wanting to replace GitHub, but with what? If GH is getting RCE's this late in the game who wants to take the chance something else won't?
.... git?
replace it with git.
if you want a whole ui you can use something like forgejo which has far fewer features likely leading to less issues.
Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
#9People keep wanting to replace GitHub, but with what? If GH is getting RCE's this late in the game who wants to take the chance something else won't?
GitLab ?
The people who suggest gitlab, haven't used it. But I guess I could be tempted to try again...
https://status.gitlab.com/pages/history/5b36dc6502d06804c083...
Re: GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
#10People keep wanting to replace GitHub, but with what? If GH is getting RCE's this late in the game who wants to take the chance something else won't?
.... git? replace it with git. if you want a whole ui you can use something like forgejo which has far fewer features likely leading to less issues.
i want what github offers.