Git patches six flaws, including code execution on recursive clones
Fixes ship in Git 2.56.1 and six older series; GitHub Enterprise Server should move to listed builds.
74
Product
GitHub Enterprise Server
- Mentions · 7d5
- Mentions · 30d11
- All mentions16
- First seenSep 21, 2026
- Last mentioned6h ago
Timeline
16 articles · newest firstGit patches six flaws that can run code from cloned repositories
The worst issue, CVE-2026-111760, scores CVSS 8.0 and needs recursive submodule cloning to swap a .git file for a symlink.
74
Git fixes recursive-clone code execution flaw CVE-2026-111760
Fixes are Git 2.56.1 and backports for the 2.50–2.55 series; the same releases patch five other flaws.
72
Git patches six flaws, including code execution on recursive clone
Fixes are in Git 2.56.1 and six maintenance releases; GitHub has patched its hosted services and listed GHES updates.
74
TeamPCP stole about 3,800 GitHub repos via poisoned developer tools
GitHub says customer-owned repositories were not accessed, but some stolen internal repos held customer support excerpts.
78
GitHub Enterprise Server versions prior to 3.19.14, 3.20.10, 3.21.8, 3.22.3 affected
GitHub Enterprise Server releases addressed vulnerabilities in versions prior to 3.19.14, 3.20.10, 3.21.8 and 3.22.3.
40
Gheist harvests secrets through malicious GitHub Actions workflows
Wiz tracked more than 13,500 malicious branches on over 850 accounts since September 15, including private enterprise repositories.
76
Gheist uses stolen GitHub tokens to leak private repository secrets
Wiz recovered over 13,500 planted branches from 850-plus accounts; GitHub’s public-repo hold does not cover private repos.
74
Gheist used stolen GitHub tokens to steal secrets from 850 accounts
Workflows on more than 13,500 branches logged secrets; public runs were held, while private and Enterprise Server runs completed.
74
Gheist uses stolen GitHub tokens to leak private repository secrets
Wiz found over 13,500 planted branches from more than 850 accounts; GitHub held public runs but not private ones.
76
Gheist abuses stolen GitHub tokens to dump repository secrets
Wiz found more than 13,500 planted branches on over 850 accounts; public runs are held, but private and enterprise repos still execute.
76
GitHub AI Can Spot Passwords Hidden in Code Before Developers Push Them
GitHub is previewing a ModernBERT classifier that blocks hidden passwords during pushes, beyond pattern-based scanning.
48
GitHub adds AI to catch passwords before a code push
GitHub is adding a ModernBERT classifier to push protection to block unstructured passwords before they enter repositories.
51
GitHub security advisory (AV26-1007)
Canada's Cyber Centre urges admins to patch vulnerable GitHub Enterprise Server 3.18 through 3.22 releases.
34
GitHub security advisory (AV26-956)
Canadian Cyber Centre urges patches for vulnerabilities in GitHub Enterprise Server 3.17 through 3.22.
42
HEIF Heist Image Flaws Let Attackers Gain RCE Across Meta, Slack and GitHub Enterprise
Hacktron's "HEIF Heist" research shows memory-unsafe HEIF/AVIF parsers enable RCE and data leaks in Slack, Meta, GitHub Enterprise, and OpenAI.
78
Related CVEs
by mentions- Heap buffer overflow in Git three-way merge via conflict-marker-size
- CVE-2026-19118<1%7.7Race Condition RCE in GitHub Enterprise Server
Appears with
- GitHubvendor · 14
- GitHub Actionsproduct · 5
- GitHub Copilotproduct · 4
- GitHuborganization · 4
- GitHub Desktopproduct · 3
- Gitvendor · 3
- Gheistthreat actor · 3
- Wizorganization · 3
- ModernBERTai model · 2
- PolinRidermalware · 2
- Gheistmalware · 2
- Trivyproduct · 2
- GitHub Enterprise Cloudproduct · 2
- GitHub Secret Protectionproduct · 2
- Wiz Researchorganization · 2
- Megalodonmalware · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.