<![CDATA[Wiz got RCE on the cloud version of Github.com and access to every customer environment.]]>Wiz got RCE on the cloud version of Github.com and access to every customer environment.

To do this they just reversed the on prem version and found a simple vuln.

X Cancelled | Verifying your request

favicon

(xcancel.com)

Link Preview Image
]]>https://board.circlewithadot.net/topic/ab39f166-f9d2-4d27-8b72-0f91d1e08f4f/wiz-got-rce-on-the-cloud-version-of-github.com-and-access-to-every-customer-environment.RSS for NodeFri, 01 May 2026 12:57:14 GMTTue, 28 Apr 2026 18:56:22 GMT60<![CDATA[Reply to Wiz got RCE on the cloud version of Github.com and access to every customer environment. on Wed, 29 Apr 2026 08:48:21 GMT]]>@GossiTheDog this is massive, have Github made a public response?

]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/stemeerkat/statuses/116487127151312844https://board.circlewithadot.net/post/https://cyberplace.social/users/stemeerkat/statuses/116487127151312844Wed, 29 Apr 2026 08:48:21 GMT<![CDATA[Reply to Wiz got RCE on the cloud version of Github.com and access to every customer environment. on Wed, 29 Apr 2026 06:35:03 GMT]]>@GossiTheDog They explicitly say so in their blog post, so ... ?

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/OmegaPolice/statuses/116486602974790691https://board.circlewithadot.net/post/https://hachyderm.io/users/OmegaPolice/statuses/116486602974790691Wed, 29 Apr 2026 06:35:03 GMT<![CDATA[Reply to Wiz got RCE on the cloud version of Github.com and access to every customer environment. on Wed, 29 Apr 2026 04:29:44 GMT]]>@GossiTheDog It’s a very Bill Clinton “depends on the meaning of the word ‘is’” approach to truth.

]]>https://board.circlewithadot.net/post/https://fosstodon.org/users/PeterUpfold/statuses/116486110239580430https://board.circlewithadot.net/post/https://fosstodon.org/users/PeterUpfold/statuses/116486110239580430Wed, 29 Apr 2026 04:29:44 GMT<![CDATA[Reply to Wiz got RCE on the cloud version of Github.com and access to every customer environment. on Tue, 28 Apr 2026 20:27:53 GMT]]>@xconde @GossiTheDog as long as they also check for abuse of the exploit and Inform you about it. Which would be handy to have a cve number attached to the report.
So, they should still fix and then notify but can't just say "cloud is not affected" if they mean, "cloud is no longer vulnerable"

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/ketumbra/statuses/116484215535156107https://board.circlewithadot.net/post/https://infosec.exchange/users/ketumbra/statuses/116484215535156107Tue, 28 Apr 2026 20:27:53 GMT<![CDATA[Reply to Wiz got RCE on the cloud version of Github.com and access to every customer environment. on Tue, 28 Apr 2026 19:57:50 GMT]]>@GossiTheDog at least while I’m in charge of issuing CVEs, we won’t do this.

]]>https://board.circlewithadot.net/post/https://social.securitytheater.net/users/spaceinvader/statuses/116484097352228217https://board.circlewithadot.net/post/https://social.securitytheater.net/users/spaceinvader/statuses/116484097352228217Tue, 28 Apr 2026 19:57:50 GMT<![CDATA[Reply to Wiz got RCE on the cloud version of Github.com and access to every customer environment. on Tue, 28 Apr 2026 19:34:24 GMT]]>@GossiTheDog Oh, phew. I thought this was an RCE impacting Wiz lightbulbs.

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/ClickyMcTicker/statuses/116484005197071391https://board.circlewithadot.net/post/https://hachyderm.io/users/ClickyMcTicker/statuses/116484005197071391Tue, 28 Apr 2026 19:34:24 GMT<![CDATA[Reply to Wiz got RCE on the cloud version of Github.com and access to every customer environment. on Tue, 28 Apr 2026 19:31:26 GMT]]>@henryk @GossiTheDog I was hoping for an exciting eyploit and was left rather disappointed ​

]]>https://board.circlewithadot.net/post/https://bsd.network/users/stsp/statuses/116483993506983693https://board.circlewithadot.net/post/https://bsd.network/users/stsp/statuses/116483993506983693Tue, 28 Apr 2026 19:31:26 GMT<![CDATA[Reply to Wiz got RCE on the cloud version of Github.com and access to every customer environment. on Tue, 28 Apr 2026 19:05:57 GMT]]>@GossiTheDog Totally 🙂

]]>https://board.circlewithadot.net/post/https://fosstodon.org/users/laurento/statuses/116483893349203432https://board.circlewithadot.net/post/https://fosstodon.org/users/laurento/statuses/116483893349203432Tue, 28 Apr 2026 19:05:57 GMT<![CDATA[Reply to Wiz got RCE on the cloud version of Github.com and access to every customer environment. on Tue, 28 Apr 2026 19:04:24 GMT]]>@GossiTheDog A header injection? In *this* economy?!

]]>https://board.circlewithadot.net/post/https://chaos.social/users/henryk/statuses/116483887228954820https://board.circlewithadot.net/post/https://chaos.social/users/henryk/statuses/116483887228954820Tue, 28 Apr 2026 19:04:24 GMT<![CDATA[Reply to Wiz got RCE on the cloud version of Github.com and access to every customer environment. on Tue, 28 Apr 2026 18:59:59 GMT]]>@GossiTheDog Can I quote you on that?

]]>https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116483869882219708https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116483869882219708Tue, 28 Apr 2026 18:59:59 GMT<![CDATA[Reply to Wiz got RCE on the cloud version of Github.com and access to every customer environment. on Tue, 28 Apr 2026 18:59:08 GMT]]>@GossiTheDog Here's a non-Twitter link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/Xavier/statuses/116483866523507563https://board.circlewithadot.net/post/https://infosec.exchange/users/Xavier/statuses/116483866523507563Tue, 28 Apr 2026 18:59:08 GMT<![CDATA[Reply to Wiz got RCE on the cloud version of Github.com and access to every customer environment. on Tue, 28 Apr 2026 18:58:56 GMT]]>@GossiTheDog You're describing the Microsoft method

]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/systemadminihater/statuses/116483865724528470https://board.circlewithadot.net/post/https://cyberplace.social/users/systemadminihater/statuses/116483865724528470Tue, 28 Apr 2026 18:58:56 GMT<![CDATA[Reply to Wiz got RCE on the cloud version of Github.com and access to every customer environment. on Tue, 28 Apr 2026 18:58:12 GMT]]>Almost every time a SaaS supplier tells you a CVE in their product doesn't apply to their SaaS version.. it means they patched it before issuing the CVE.

]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/GossiTheDog/statuses/116483862879721423https://board.circlewithadot.net/post/https://cyberplace.social/users/GossiTheDog/statuses/116483862879721423Tue, 28 Apr 2026 18:58:12 GMT