GitHub: Zounds, a genuinely helpful AI-assisted bug report that isn't total slop! Here, Wiz, take this wad of cash

Wiz disclosed CVE-2026-3854, a flaw in GitHub's git infrastructure where maliciously crafted git push options (containing a null-byte delimiter) could be injected into internal X-Stat headers and grant full read/write access to private repositories; Wiz used AI-assisted reverse engineering to produce a working exploit rapidly, GitHub issued fixes and hardening within six hours, confirmed no known abuse on GitHub.com, and advised GitHub Enterprise Server customers to review access logs.