Yes, I know GitHub does a lot more than Git these days.

Actions, packages, security tooling, issue tracking, enterprise management, AI features, code search, and half the software industry glued into one UI.

But that is exactly why this story is so funny in the worst possible way.

When a company built around Git takes a critical hit in the git push pipeline , my reaction is pretty simple:

guys, this was the one thing you absolutely had to not mess up.

That is my opinion here, and I do not think it is unfair.

GitHub failed at the only thing they should do: Git.

what happened

On April 28, GitHub published two important posts about a serious incident and the vulnerability behind it.

Wiz also published its own breakdown of the issue, tracked as CVE-2026-3854 .

The short version:

Wiz described it as a CVSS 8.7 remote code execution vulnerability

the affected area was GitHub’s git push pipeline

GitHub said it validated, fixed, and investigated the issue in under two hours

GitHub also said it found no…