GitHub fixed critical RCE vulnerability CVE-2026-3854 within 2 hours after discovery

<cite index="31-1,32-1,38-11">Critical vulnerability CVE-2026-3854 allowed remote code execution on GitHub via a single git push command using an injection flaw in internal protocols</cite>. <cite index="35-2,32-6">On GitHub.com, attackers could access millions of repositories on shared storage nodes across organizations</cite>. <cite index="38-12,34-12">GitHub fixed the vulnerability within 2 hours and found no evidence of exploitation</cite>.

<cite index="3-1,3-21">GitHub detailed defense-in-depth security architecture for agentic workflows in CI/CD pipelines, focusing on isolation and constrained execution</cite>. <cite index="3-23,3-24">Agentic workflows enable AI agents to interpret intent and execute tasks within GitHub Actions while expanding attack surface with risks like prompt injection</cite>. <cite index="3-29,3-30">Agents run in sandboxed environments with restricted permissions, operating in read-only mode by default</cite>.

<cite index="8-1,8-6">GitHub introduced AI-powered security detections in Code Security to expand vulnerability coverage across languages and frameworks beyond CodeQL</cite>. <cite index="8-18,8-19">Internal testing processed over 170,000 findings with 80% positive developer feedback, showing strong coverage for Shell/Bash, Dockerfiles, Terraform, and PHP</cite>. <cite index="8-8,8-14">Public preview planned for early Q2 2026</cite>.

<cite index="7-6,7-18">GitHub introduced models-as-data capability for CodeQL, allowing developers to define custom sanitizers and validators without writing queries</cite>. <cite index="7-19,7-21">Update enables teams to configure trusted data handling and integrate security more deeply into developer workflows</cite>. <cite index="7-24">Enhancement aims to close coverage gaps and improve vulnerability detection accuracy by reducing need for custom query development</cite>.

<cite index="43-1,43-2">Beacon beta will become part of Atlassian Guard Premium with CSV exports now showing 'Guard Detect' instead of 'Beacon'</cite>. <cite index="42-2,42-7">Atlassian consolidated Access and Beacon under Guard branding - Standard for identity management and Premium for threat detection</cite>. <cite index="42-31">Guard Premium addresses cloud migration blockers with audit logs, API token controls, and sensitive data leak detection</cite>.

<cite index="16-10,16-12">Azure DevOps Server GA faced group membership deactivation issue, prompting Microsoft to temporarily remove download links</cite>. <cite index="16-18,16-24">Patch released March 13, 2026 resolved the issue with corrected release re-published</cite>. <cite index="20-16,20-18">Product moved to Modern Lifecycle Policy with more frequent updates instead of two-year major version cycles</cite>.

<cite index="15-11,15-12">Starting GitLab 18.8 (January 2026) on GitLab.com and 18.9 (February 2026) for self-managed, Vulnerabilities over time chart excludes no longer detected vulnerabilities</cite>. <cite index="15-13,15-15">Change may result in drop in total vulnerabilities shown, with background migration handling remaining vulnerabilities from earlier pipelines</cite>. <cite index="15-16,15-18">Known issues may affect dependency and container scanning vulnerability counts</cite>.

<cite index="23-1,23-5">Atlassian published April 21, 2026 security bulletin with vulnerabilities discovered through Bug Bounty program and third-party scans</cite>. <cite index="23-3,23-4">Critical Security Advisories issued for immediate critical risks outside monthly bulletin schedule as necessary</cite>. <cite index="23-6,23-7">Recommends patching to latest or fixed versions with Vulnerability Disclosure Portal available for CVE searches</cite>.