GitHub Pays $100,000 Bounty for Critical RCE Flaw Triggered by a Single Git Push

GitHub has reportedly awarded a $100,000 bug bounty to security researcher Saif Ghani for identifying a critical remote code execution vulnerability that could be triggered through a specially crafted Git repository operation. The flaw, tracked as CVE-2026-3854, was disclosed publicly on July 22 after GitHub remediated the issue through its coordinated vulnerability disclosure process. The reported vulnerability affected GitHub’s handling of crafted repository URLs or Git…