GitHub Enterprise Server (Product): news timeline & CVEs

GitHub security advisory (AV26-956)

Canadian Cyber Centre urges patches for vulnerabilities in GitHub Enterprise Server 3.17 through 3.22.

The Canadian Centre for Cyber Security issued advisory AV26-956 on September 23, 2026, stating that as of September 22 GitHub Enterprise Server is affected by vulnerabilities. Affected ranges are 3.17.0 before 3.17.21, 3.18.0 before 3.18.15, 3.19.0 before 3.19.12, 3.20.0 before 3.20.8, 3.21.0 before 3.21.6, and 3.22.0 before 3.22.1. The bulletin does not name CVEs or report exploitation and urges administrators to review GitHub release notes and apply updates.

Canadian Centre for Cyber SecuritySep 23, 17:49 UTC · 3d agoAdvisory

HEIF Heist Image Flaws Let Attackers Gain RCE Across Meta, Slack and GitHub Enterprise

Hacktron's "HEIF Heist" research shows memory-unsafe HEIF/AVIF parsers enable RCE and data leaks in Slack, Meta, GitHub Enterprise, and OpenAI.

Hacktron disclosed a class of attack paths in the HEIF/AVIF decoding ecosystem, chiefly memory-unsafe libheif and libde265 parsers reached via ImageMagick, libvips, and Sharp, enabling heap disclosure and remote code execution. The team demonstrated RCE paths in Slack, Meta's product suite, GitHub Enterprise Server (CVE-2026-19118, authenticated RCE), Discourse, and Next.js. They chained a libheif heap buffer overflow with an OpenAI SSO flaw to compromise employee ChatGPT accounts in July 2026, earning a $6,500 bounty; OpenAI patched within 14 hours. AI-assisted agentic workflows reportedly cut exploit development to one to three days.

GBHackersupdated Sep 22, 09:51 UTC · 4d agofirst Sep 21, 08:17 UTC · 6d agoResearch in the wild 3 sources CVE-2026-19118

GitHub Enterprise Server

Timeline2 articles

Related CVEsby mentions

Appears with

GitHub security advisory (AV26-956)

HEIF Heist Image Flaws Let Attackers Gain RCE Across Meta, Slack and GitHub Enterprise