Noma Labs identified a prompt injection vulnerability in GitHub's Agentic Workflows, allowing unauthenticated attackers to access private repository data by posting a crafted GitHub Issue in a public repository within the same organization. This vulnerability has been named GitLost.

Wiz Research identified a critical vulnerability (CVE-2026-3854) in GitHub's internal git infrastructure that allows authenticated users to execute arbitrary commands on backend servers with a single git push command. This vulnerability is notable as one of the first critical flaws found in closed-source binaries using AI.

A CMU study identified 6 million fake stars across 18,617 GitHub repositories, primarily from 301,000 accounts, with AI/LLM repositories being the largest non-malicious category. Fake stars are sold for prices ranging from $0.03 to $0.85 on various platforms, including Fiverr and Telegram.

GitHub's historical uptime charts display monthly uptime statistics from 2016 to 2026. Users can visualize the platform's reliability trends over the specified period.