GitHub Let a Git Push Hijack Its Servers (RCE CVE-2026-3854)

Wiz turned a git push into remote code execution on GitHub. Five days earlier, the merge queue silently un-merged 2,092 PRs. One platform, one bad week. GitHub published two posts on April 28, 2026. One was the CTO apologizing for reliability. The other was a critical remote code execution vulnerability in the git push pipeline. Same morning, same platform. 1 2 TL;DR: Wiz found that a single git push with crafted options could run code on GitHub's servers, outside any sandbox (CVE-2026-3854, CVS