GitHub patched a critical RCE vulnerability (CVE-2026-3854)

Wiz researchers discovered a critical remote code execution vulnerability in GitHub's git push pipeline (CVE-2026-3854, CVSS 8.7). The flaw allowed a single git push with crafted options to execute code on GitHub's servers outside any sandbox. GitHub patched the vulnerability within 75 minutes of disclosure on March 4, but public disclosure was held until April 28 to allow Enterprise Server customers to patch.

Microsoft announced GitHub Secret Protection and GitHub Code Security are now available as standalone products for Azure DevOps, separate from the bundled Advanced Security package. The move allows customers to purchase specific security capabilities independently, with Secret Protection covering secret scanning and push protection, while Code Security handles dependency and code scanning features.

Atlassian launched the Jira 2026 Spring Release featuring new Space Insights capabilities and improved beta feature management in the admin interface. The release addresses user feedback about difficulty tracking changes and includes enhanced reporting options, though some users report rollout inconsistencies between admin interfaces and actual feature availability.

Atlassian published a comprehensive security bulletin addressing 31 high-severity and 7 critical third-party vulnerabilities across Jira, Confluence, and Bitbucket products. The April 21 bulletin emphasizes upgrading to latest versions, with particular focus on RCE vulnerabilities in Confluence Data Center and Server platforms that could impact DevOps data protection workflows.

Atlassian announced the complete retirement of Bitbucket Issues and Wikis features, effective August 20, 2026. Starting April 2026, these features can no longer be enabled for new repositories. The move aims to improve reliability and integrate Bitbucket data into the unified Atlassian platform including Rovo, though it eliminates simple issue tracking capabilities that competed with more complex Jira workflows.

Atlassian introduced Confluence Remix and Model Control Protocol (MCP) compatible partner agents that can transform documentation into executable outputs across connected tools like Replit and Lovable. The feature leverages the Teamwork Graph with over 100 billion data points to maintain context and relationships when content moves between platforms, representing a significant AI integration for knowledge management workflows.

Tenable disclosed a critical vulnerability in a popular Microsoft GitHub repository that could allow attackers to execute arbitrary code and access secrets through vulnerable GitHub workflows. The flaw highlights growing security risks in CI/CD pipelines as they become central to software development, with the affected repository having 5,000+ forks and 7,700+ stars, demonstrating significant developer exposure.