GitHub Patched a Critical RCE Bug in Under 6 Hours — Here’s What Happened

GitHub’s security team had a rough morning last month, but they handled it fast. A critical remote code execution vulnerability in their internal git infrastructure was discovered by Wiz Research, and the clock started ticking.

The bug wasn’t some minor config issue. Wiz used AI models to dig into GitHub’s internals and found a flaw that could have let attackers reach into both public and private repositories — all millions of them. That’s the kind of thing that keeps platform engineers up at night.

GitHub’s CISO Alexis Wales shared the timeline, and it’s actually impressive. “Within 40 minutes, we had reproduced the vulnerability internally and confirmed the severity,” he said. That’s not just a standard bug bounty triage — that’s a team that knows their infrastructure cold. They didn’t waste time arguing about whether it was real or not.

From there, the engineering team built a fix and pushed it live. Total time from report to deployment: under six hours. For a remote code execution bug in core git infrastructure, that’s borderline surgical.

What I find interesting here is the AI angle. Wiz didn’t just stumble on this with fuzzing or manual code audits — they used AI models to find it. That’s becoming a recurring theme in vulnerability research. AI is good at pattern recognition at scale, and git infrastructure is massive and complex. I expect we’ll see more of these AI-assisted finds in the coming months, especially in platforms with large codebases.

The fix is live now, and GitHub has credited Wiz Research appropriately. No word on whether this was a full disclosure or coordinated, but given the speed of the patch, it’s safe to assume they handled it responsibly.

What I’d like to see next is more transparency from GitHub about what exactly was vulnerable. The “internal git infrastructure” description is vague. Was it the API layer? The git server itself? A misconfigured service? Knowing the root cause helps other platform teams learn from this.

Either way, this is a good example of how fast a mature security team can move when the stakes are high. Six hours for a critical RCE is a benchmark worth noting.