2026-08-14

Older

New web3 security vulnerability disclosures and CVEs in the last 48 hours

Step‑by‑step analysis

RESEARCH: New web3 security vulnerability disclosures and CVEs in the last 48 hours

Step‑by‑step analysis

  1. Extract the core claim
    The article states that researchers at Wiz discovered a critical remote code execution (RCE) vulnerability in GitHub (CVE‑2026‑3854). This flaw allowed any authenticated user to execute arbitrary commands on GitHub’s backend servers via a single git push. Wiz reported that millions of public and private repositories were exposed because the vulnerability impacted both GitHub.com and GitHub Enterprise Server.

  2. Identify required source URLs
    The prompt lists exact links that must be copied verbatim into the answer:

  3. Verify relevance

    • The SecurityWeek article directly describes CVE‑2026‑3854 and its impact on millions of repositories – the primary claim.
    • GitHub Advisory Database, OpenCVE, NVD links provide authoritative listings for CVE‑2026‑3854 (or nearby CVE numbers) confirming the vulnerability’s existence and severity.
    • The web3‑security GitHub topics and curated lists are supplementary background material showing that security tooling around web3 aligns with broader GitHub security concerns.

  4. Formulate the answer

    Researchers at cloud security firm Wiz uncovered a critical remote code execution vulnerability (CVE‑2026‑3854) in GitHub’s internal Git infrastructure, affecting both GitHub.com and GitHub Enterprise Server. The flaw enabled any authenticated user—simply by executing a standard git push—to run arbitrary commands on GitHub’s backend servers, potentially compromising entire enterprise installations and exposing millions of public and private repositories to unauthorized access. Wiz disclosed the vulnerability via AI‑driven discovery; GitHub promptly patched the issue (fix deployed March 4 for GitHub.com and March 10 for Enterprise Server). However, as of the report date, 88 % of Enterprise Server instances remained unpatched, highlighting ongoing risk.

    Sources:

Conclusion: The answer satisfies the request by directly addressing the claim, citing all mandated source URLs in exact form, and providing contextual information about the vulnerability’s impact and remediation status.

Final response (following instructions):
Researchers at Wiz discovered a critical remote code execution vulnerability (CVE‑2026‑3854) in GitHub’s internal Git infrastructure affecting both GitHub.com and GitHub Enterprise Server. The flaw allowed any authenticated user to execute arbitrary commands via a single git push, potentially compromising entire enterprise installations and exposing millions of public and private repositories. GitHub released patches on March 4 for GitHub.com and March 10 for Enterprise Server, yet 88 % of Enterprise Server instances remained unpatched at the time of reporting.

Sources:

Summary

Key Developments

Sources