# New Video: deep dive into CVE-2026–3854 — a critical RCE in GitHub

**URL:** <https://threatmodelingconnect.discourse.group/t/new-video-deep-dive-into-cve-2026-3854-a-critical-rce-in-github/1244>\
**Category:** General\
**Created:** [May 26, 2026, 6:23pm UTC](https://threatmodelingconnect.discourse.group/t/new-video-deep-dive-into-cve-2026-3854-a-critical-rce-in-github/1244 "2026-05-26T18:23:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mohamed\_AboElKheir](https://sea2.discourse-cdn.com/flex002/user_avatar/threatmodelingconnect.discourse.group/mohamed_aboelkheir/32/179_2.png) [@Mohamed\_AboElKheir](https://threatmodelingconnect.discourse.group/u/Mohamed_AboElKheir)\
**Post date:** [May 26, 2026, 6:23pm UTC](https://threatmodelingconnect.discourse.group/t/new-video-deep-dive-into-cve-2026-3854-a-critical-rce-in-github/1244/1 "2026-05-26T18:23:24Z")

</div>

📢 New video on the “AppSec Untangled” YouTube channel!

In this video, I do a deep dive into CVE-2026–3854 — a critical RCE in GitHub where a single git push command with a carefully crafted option was enough to execute code on GitHub’s backend and access millions of private repositories belonging to other customers 🔓

I also cover 4 practical lessons we can take from this as application security engineers:

🔹 Input validation — and why it needs to apply at every level of nesting, not just the outer layer  
🔹 Why SAST wouldn’t have caught this — and what to do instead  
🔹 Least privilege — scoping down credentials to limit blast radius  
🔹 Tenant isolation — and why application-level isolation isn’t always enough

Hope you find it useful!  
Link 🔗: [https://youtu.be/XPcTuNEPLu0](https://youtu.be/XPcTuNEPLu0)

---

<div class="post-metadata">

**Author:** ![hewerlin](https://sea2.discourse-cdn.com/flex002/user_avatar/threatmodelingconnect.discourse.group/hewerlin/32/67_2.png) [@hewerlin](https://threatmodelingconnect.discourse.group/u/hewerlin)\
**Post date:** [May 31, 2026, 7:15am UTC](https://threatmodelingconnect.discourse.group/t/new-video-deep-dive-into-cve-2026-3854-a-critical-rce-in-github/1244/2 "2026-05-31T07:15:56Z")

</div>

Thanks for sharing!

It is both unsettling and reassuring to see that even major players are not immune to this kind of thing.