GitHub ships critical RCE fix (CVE-2026-3854) and launches

<cite index="1-1,1-4">GitHub announced the GitHub Security Lab Taskflow Agent, an open source AI framework for security research that triages vulnerabilities in GitHub Actions and JavaScript projects. The agent is effective at finding Auth Bypasses, IDORs, Token Leaks, and other high-impact vulnerabilities.</cite>

<cite index="4-16,4-18">GitHub outlined its 2026 Actions security roadmap, shifting toward secure-by-default, verifiable automation designed to move Actions toward a secure by default, auditable automation platform without requiring teams to rebuild their CI/CD model from scratch.</cite>

<cite index="9-2,9-13">Microsoft announced expanded integration between Microsoft Defender and GitHub Code Security at Build 2026, making Defender more attractive if you already use GitHub. The announcements focus on Agent 365 runtime controls and unified AI development lifecycle governance.</cite>

<cite index="13-3,13-8">GitLab released version 19.0 with CI/CD credentials management inside GitLab Secrets Manager and live view of which versions are running where, helping security fixes land across organizations.</cite>

<cite index="26-1,26-6,26-12">Azure DevOps announced features planned for June 2026 including Purge agents for manual recycling, Pool Alias for improved naming, and Spot Virtual Machines instances to reduce costs by up to 90% for non-time-critical pipelines.</cite>

<cite index="41-1,47-21">Bitbucket will run controlled brownouts from June 9, 2026 to July 27, 2026 for app password migration, after which app passwords will be fully removed on July 28, 2026. During brownouts, API requests will fail with HTTP 401 and Git operations with HTTP 410.</cite>