GitHub Patched a Critical RCE Bug in Under 6 Hours — Here’s What Happened

Last month, GitHub’s security team had a bad afternoon — followed by a very good one.

Wiz Research, the same crew that keeps finding nasty cloud holes, used AI models to dig into GitHub’s internal git infrastructure. What they found was a remote code execution vulnerability that could have let attackers waltz into millions of public and private code repositories. Not a typo-level bug. This was the kind that makes CISOs cancel their dinner plans.

GitHub’s Chief Information Security Officer Alexis Wales shared the timeline publicly, and honestly, it’s impressive:

“Our security team immediately began validating the bug bounty report. Within 40 minutes, we had reproduced the vulnerability internally and confirmed the severity.”

Forty minutes from report to reproduction and severity confirmation. That’s not just fast — that’s a team that has its incident response playbook memorized and rehearsed.

From there, the engineering team built a fix and pushed it out. Total time from initial report to deployed patch: under six hours. For a critical remote code execution vulnerability in core infrastructure, that’s about as fast as you can reasonably expect without breaking things.

What’s interesting here isn’t just the speed — it’s the AI angle. Wiz used AI models to find this thing. We’re past the point where AI is just generating blog summaries or writing bad poetry. It’s now finding real, exploitable security flaws in production infrastructure. That shifts the threat landscape in a way most companies aren’t ready for.

GitHub handled this one well. The bug bounty program worked exactly as designed: researcher finds something nasty, reports it, company fixes it fast, nobody gets pwned. But the takeaway for everyone else should be that AI-assisted vulnerability research is only going to accelerate. If your security team isn’t already thinking about how attackers might use AI to find holes in your stack, you’re already behind.

No dramatic conclusion here. GitHub did the right thing, did it fast, and shared the timeline so the rest of us can learn from it. That’s how security should work.