GitHub patched a critical RCE bug in under six hours — here’s what happened

GitHub had a bad day last month — or rather, a bad few hours. A critical remote code execution vulnerability was discovered in their internal git infrastructure, and the clock started ticking. The kicker? It was found by Wiz Research, using AI models to probe places humans might not think to look.

If exploited, this bug could have let an attacker access millions of public and private code repositories. That’s the kind of thing that keeps platform security teams up at night. GitHub’s response, though, was impressively fast.

According to Alexis Wales, GitHub’s chief information security officer, the security team validated the bug bounty report within 40 minutes. They reproduced the vulnerability internally and confirmed it was critical. Then engineering went to work. A fix was developed and deployed in under six hours from initial report.

Forty minutes to reproduce. Six hours to ship a fix. That’s not just fast — that’s the kind of response you get when you’ve got a well-rehearsed incident response playbook and a team that doesn’t panic.

What caught my attention here isn’t just the speed, but the method. Wiz used AI to surface the vulnerability. That’s a trend I expect we’ll see more of — attackers and researchers alike using LLMs and other models to find edge cases in complex infrastructure. Git internals are notoriously tangled, and AI is good at spotting patterns that look wrong.

The full technical details are still under wraps, and Wiz hasn’t published a deep dive yet. I’d love to see the specifics once they do — understanding what exactly the AI flagged and how could teach us a lot about where our own infrastructure might be vulnerable.

GitHub’s response sets a bar. Not every company can move that fast, but the combination of AI-assisted discovery and a tight incident response loop is something worth studying. I’m not saying every org needs to fix bugs in six hours — but having a process that doesn’t take days to even acknowledge the problem? That’s achievable.

For now, the vulnerability is patched, the repositories are safe, and Wiz Research gets another notch on their belt. I’ll be watching for their write-up.