--- title: Wiz hands GitHub AI-aided bug report that isn't total slop description: Wiz researchers discovered a high-severity vulnerability (CVE-2026-3854, CVSS 8.8) in GitHub's git infrastructure that allowed remote attackers full read/write... canonical: https://daily.dev/posts/wiz-hands-github-ai-aided-bug-report-that-isn-t-total-slop-vpin6zwzj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Wiz hands GitHub AI-aided bug report that isn't total slop | daily.dev og:description: Wiz researchers discovered a high-severity vulnerability (CVE-2026-3854, CVSS 8.8) in GitHub's git infrastructure that allowed remote attackers full read/write... og:url: https://daily.dev/posts/wiz-hands-github-ai-aided-bug-report-that-isn-t-total-slop-vpin6zwzj og:image: https://api.daily.dev/og/posts/Vpin6zwzj.png og:image:alt: Wiz hands GitHub AI-aided bug report that isn't total slop og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Wiz hands GitHub AI-aided bug report that isn't total slop **[The Register](https://daily.dev/sources/theregister)** · 5 min read · 0 upvotes · 0 comments ## Summary Wiz researchers discovered a high-severity vulnerability (CVE-2026-3854, CVSS 8.8) in GitHub's git infrastructure that allowed remote attackers full read/write access to private repositories via a single command. The flaw stemmed from GitHub's internal services blindly trusting user-supplied push option values, which could be manipulated using a null byte delimiter to inject trusted internal metadata. Wiz used Claude Code and IDA MCP for AI-augmented reverse engineering of GitHub's closed-source binaries, compressing what would have been months of manual work into under 48 hours. GitHub patched the vulnerability within six hours of disclosure and confirmed no exploitation in the wild. Wiz is set to receive one of the largest payouts in GitHub's bug bounty history, with critical bugs typically earning $20,000–$30,000 and the record payout being $75,000. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Critical GitHub RCE bug exposed millions of repositories](https://daily.dev/posts/critical-github-rce-bug-exposed-millions-of-repositories-qqjftnlqc) · CSO Online · 0 upvotes · 0 comments - [GitHub will start paying some bug bounty hunters in swag instead of cash](https://daily.dev/posts/github-will-start-paying-some-bug-bounty-hunters-in-swag-instead-of-cash-aa2efuue8) · The New Stack · 0 upvotes · 1 comments - [Securing the git push pipeline: Responding to a critical remote code execution vulnerability](https://daily.dev/posts/securing-the-git-push-pipeline-responding-to-a-critical-remote-code-execution-vulnerability-l4isyrjtr) · GitHub Blog · 3 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#claude](https://daily.dev/tags/claude), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/wiz-hands-github-ai-aided-bug-report-that-isn-t-total-slop-vpin6zwzj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Wiz hands GitHub AI-aided bug report that isn't total slop","url":"https://daily.dev/posts/wiz-hands-github-ai-aided-bug-report-that-isn-t-total-slop-vpin6zwzj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/wiz-hands-github-ai-aided-bug-report-that-isn-t-total-slop-vpin6zwzj"},"datePublished":"2026-04-29T13:08:20.558Z","dateModified":"2026-05-06T14:40:19.193Z","description":"Wiz researchers discovered a high-severity vulnerability (CVE-2026-3854, CVSS 8.8) in GitHub's git infrastructure that allowed remote attackers full read/write...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1264574bad5d0b930c49b935ea2009de?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1264574bad5d0b930c49b935ea2009de?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/wiz-hands-github-ai-aided-bug-report-that-isn-t-total-slop-vpin6zwzj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,claude,reverse-engineering","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Wiz hands GitHub AI-aided bug report that isn't total slop"}]} ```