GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

> April 28, 2026

> GitHub Enterprise Server customers should upgrade immediately - at the time of this writing, our data indicates that 88% of instances are still vulnerable

> Upgrade to GHES version 3.19.3 or later

https://docs.github.com/en/[email protected]/admin/rele... :

> Enterprise Server 3.19.3 - March 10, 2026

88% of on-prem customers haven't applied a critical security fix from 7 weeks ago, that seems ... bad.

I was impressed enough by AI finding vulnerabilities in source code, but doing it in binary executables is just amazing. This has so much potential, good and bad.

And yet another lesson to not treat data as instructions. Sanitize all user input!

People keep wanting to replace GitHub, but with what?

If GH is getting RCE's this late in the game who wants to take the chance something else won't?

GitHub case will be thought in schools how to screw up almost monopolistic position in the market in couple years. This is beyond bonkers.