GitHub suffered a 7-hour, 47-minute outage on August 17 that disrupted github.com, authentication, GitHub Actions, APIs, pull requests, issues, and Copilot worldwide. GitHub said traffic had reached a new peak when a critical infrastructure component in its Central US data center failed to scale, creating capacity pressure that spread across its systems. Most services recovered that day after teams rerouted traffic and isolated affected infrastructure, while some Copilot services took longer because client-side retry loops increased traffic during recovery. The outage was GitHub’s second significant August incident, following an August 6 GitHub Actions failure. GitHub said neither event resulted from a code or configuration change; both were capacity failures. Monthly commits grew from 1.4 billion in April to 2.9 billion, increasing system demand. Since April, GitHub has added more than 3 million CPU cores, 120 petabytes of high-speed storage, and additional network capacity, while accelerating its migration to Azure. Azure now handles about 58% of GitHub platform load and half of Git operations, up from 12% of platform load in May. GitHub plans to limit retries and apply retry budgets and variable timeouts between services, review lower-priority CPU and memory alerts, isolate critical systems, and remove shared dependencies. It is also developing an architecture intended to scale read capacity linearly for large monorepos.

GitHub.com is experiencing degraded performance, particularly in Git Operations. A problematic component has been identified and corrective actions are underway, but residual impacts are affecting multiple services.

Multiple GitHub services are experiencing issues, causing workflow runs to fail or be delayed, and some queued jobs may time out. Engineers are implementing mitigations and rolling out a fix across all affected systems.

Stacked pull requests are now in public preview on GitHub, allowing users to break large changes into smaller, reviewable pull requests. This feature enables independent review of each pull request in a series, facilitating easier merging of changes with a single action.

Thousands of repositories on GitHub are currently distributing malware, accessible through the standard search function without special knowledge. Despite having a substantial budget, a dedicated security team, and AI resources, GitHub has not resolved this issue over the past two years.

The main branch of the repository liang-wenfeng-investor-meeting-2026-7-22 does not contain the file 梁文锋投资者交流会-文字稿_1_18_translate_20260723201651.pdf. Feedback is taken seriously and can be reviewed in the documentation.

GitHub is restructuring its bug bounty program to enhance collaboration with the security research community and improve overall platform safety. Changes to the program aim to better recognize and reward researchers for identifying and reporting vulnerabilities.

Noma Labs identified a prompt injection vulnerability in GitHub's Agentic Workflows, allowing unauthenticated attackers to access private repository data by posting a crafted GitHub Issue in a public repository within the same organization. This vulnerability has been named GitLost.

Two months ago I was fired by Google for creating the Google Workspace CLI. It went viral, hit #1 on Hacker News, gained thousands of GitHub stars and many thousands of actual users in just a couple days. It was an incredible, confusing journey, from directors and leaders asking what they could learn from the tool to getting grilled by legal about why the Google logo and brand colors are on the Go...

A large-scale malware distribution campaign on GitHub has been identified, involving 10,000 repositories that distribute Trojan malware. These repositories originate from different contributors and share a common pattern, enabling the creation of a script to find them.