GitHub rotates keys to mitigate impact of credential-exposing flaw

GitHub patched a critical unsafe reflection vulnerability (CVE-2024-0200) that could allow authenticated organization owners to access environment variables — including credentials — in production containers and potentially achieve remote code execution; the company rotated potentially exposed keys and urged customers to install GHES updates. A separate high-severity command-injection bug (CVE-2024-0507) affecting the Management Console was also fixed; GitHub reports no evidence of prior exploitation and recommends importing new public keys where applicable.