GitHub Patched a Critical Flaw in Under Six Hours — Here’s What Happened

Last month, GitHub’s security team had a bad Monday morning — and then a surprisingly good one.

A group of researchers from Wiz Research, using AI models to probe GitHub’s internal git infrastructure, found a remote code execution vulnerability. The kind that could have let attackers walk right into millions of public and private code repositories. Not a simulated drill. The real thing.

GitHub’s chief information security officer, Alexis Wales, says the team got the bug bounty report, validated it, and reproduced the exploit internally — all within 40 minutes. That’s not a typo. Forty minutes to confirm a critical remote code execution hole in infrastructure that stores a huge chunk of the world’s source code.

“This was a critical issue that required immediate action,” Wales said, in what has to be the understatement of the month.

From there, the engineering team built a fix and pushed it out. Total time from first report to deployment: under six hours. For context, most organizations take days or weeks to even triage a critical vulnerability. GitHub moved faster than many teams can schedule a standup meeting.

What I find interesting here isn’t just the speed — it’s the AI angle. Wiz didn’t stumble onto this bug by fuzzing or manual code review. They used AI models to find it. That’s a shift worth paying attention to. Security researchers have been talking about AI-assisted vulnerability discovery for a while, but this is one of the more concrete examples I’ve seen of it actually working against a major target. And it worked well enough to find a flaw in GitHub’s own infrastructure.

The flip side, of course, is that the same techniques are available to attackers. If AI can help find bugs for defenders, it can help find bugs for everyone else too. This is the kind of story that security folks will be citing in arguments for better AI threat modeling for the next few years.

GitHub hasn’t disclosed whether the vulnerability was ever exploited in the wild. Given the response time, I’d guess not — but we may never know for sure. What we do know is that the fix is live, and the bug bounty paid out. No word on the amount, but for a critical RCE in GitHub’s core infrastructure, I hope it was a good one.

The whole episode is a reminder that even the most battle-hardened platforms have blind spots. The difference is how fast they can react when someone shines a light on them. Six hours is a new bar for incident response. I just hope the rest of the industry is paying attention.