Loading story…
GitHub suffered a widespread global outage that disrupted major platform components including the website, API, Pull Requests, Issues, Actions, Webhooks, and Copilot, leaving developers and enterprise customers unable to reliably access repositories and collaboration features. GitHub reported roughly 20% error rates across web and API traffic, while archive downloads and raw repository content downloads were failing at about 50%, indicating broad impact across both interactive use and automated consumption of code.
The incident also affected GitHub Enterprise Cloud identity services, including SAML, OIDC, SCIM provisioning, and Team Sync, causing single sign-on and account-management problems for organizations that depend on GitHub for source control, CI/CD, and automation. GitHub said engineers were investigating the disruption, applying mitigations, and monitoring for improvement, but had not disclosed a root cause, estimated time to resolution, or any confirmed connection to a cyberattack at the time of reporting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
14 events from the most recent confirmed update back to the earliest known activity.
At approximately 15:21 UTC on August 17, 2026, GitHub reported degraded performance affecting Git Operations during the ongoing platform disruption.
At approximately 15:10 UTC on August 17, 2026, GitHub reported degraded performance affecting GitHub Pages as the outage spread to additional services.
At approximately 15:01 UTC on August 17, 2026, GitHub escalated API Requests from degraded performance to degraded availability during the continuing incident.
At 14:58 UTC on August 17, 2026, GitHub said about 20% of web and API traffic was still returning errors and that engineers were applying mitigations while monitoring for improvement.
At 14:58 UTC on August 17, 2026, GitHub disclosed that SAML, OIDC, SCIM, and Team Sync were affected, extending the outage to enterprise identity and organization-management features.
At about 14:31 UTC on August 17, 2026, GitHub confirmed that Copilot was also experiencing degraded availability during the broader outage.
At 14:24 UTC on August 17, 2026, GitHub said web and API traffic were experiencing roughly 20% error rates, while archive and raw repository downloads were failing at about 50%.
At approximately 13:58 UTC on August 17, 2026, GitHub reported Issues as degraded as the incident expanded across core collaboration features.
Around 13:42 UTC on August 17, 2026, GitHub added Pull Requests to the list of affected components during the ongoing outage.
At about 13:40 UTC on August 17, 2026, GitHub said it was investigating performance problems affecting some services as a broad outage impacted web and API traffic.
Downdetector reported a spike in user complaints near 13:30 UTC on August 17, 2026, as a major GitHub service disruption began affecting users worldwide.
In April 2026, GitHub introduced a more transparent status-reporting framework with granular severity tiers and 90-day uptime metrics for individual services.
GitHub published a postmortem for the August 17, 2026 outage, saying the disruption lasted nearly eight hours and began when traffic hit a new peak that a critical Central US infrastructure component failed to scale for. The company said the resulting capacity pressure triggered authentication failures and outlined immediate mitigations including retry limits, retry budgets, and adjusted service-to-service timeouts.
GitHub disclosed that the August 17 outage was caused by a misconfigured autoscaling policy affecting an Istio sidecar pod in its Central US region, which led to network saturation and cascading failures. The company also outlined corrective actions including fixing autoscaling policies, auditing Istio limits, and reviewing retry and failover behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
thenewstack.io
Open sourceitpro.com
Open sourceinfoworld.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcethecybersecguru.com
Open sourcebleepingcomputer.com
Open sourcegithubstatus.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Datadog Security Research reported sustained campaigns abusing GitHub’s public and authenticated APIs to enumerate enterprise organizations, repositories, and users while blending into normal developer traffic. The activity relied on automated scraping through endpoints including `/graphql`, dormant “ghost” GitHub accounts, and in some cases compromised OAuth tokens or personal access tokens. Researchers identified more than 50 ghost accounts since October 2025, along with recurring user agents such as `GitHub-Company-Scraper`, `GitHub-Scraper-Tool/1.0`, `GitHubAnalytics/1.5`, `GitHub-Commit-Fetcher/1.3`, `GitHub-Commit-Fetcher/1.4`, and `GitHub-Event-Fetcher/2.2`, with some infrastructure linked to 3xK Tech. While much of the traffic queried public data and appeared benign in isolation, researchers said the aggregate behavior amounted to coordinated reconnaissance that could support later theft of secrets, repository cloning, or broader intrusion activity. In a more serious observed case, a tool identified as `repo-dumper` successfully cloned or accessed a private repository, with GitHub audit logs showing `git.clone` and `api.request` events against private paths. Defenders were urged to baseline GitHub audit activity and hunt for unusual user agents, actor names, token types, source ASNs, and successful access to private resources, while also enforcing MFA, conducting access reviews, enabling audit log streaming, and using repository secret scanning.
Jul 11, 2026
GitHub disclosed and patched **CVE-2026-3854**, a critical command-injection flaw in its `git push` pipeline that allowed an authenticated user with repository push access to trigger remote code execution using a single crafted push. Wiz reported the bug on March 4, and GitHub said it reproduced the issue within about 40 minutes and deployed a fix to GitHub.com within roughly two hours, later publishing patches for supported GitHub Enterprise Server releases including **3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, and 3.19.3**. The vulnerability stemmed from unsanitized user-supplied push option values being inserted into internal `X-Stat` headers, enabling attackers to inject trusted metadata, bypass sandboxing, and execute commands as the `git` service user. Researchers said the flaw could have led to **full server compromise** on GitHub Enterprise Server and, on GitHub.com, code execution on shared storage infrastructure where millions of repositories were accessible to the git service account, creating potential cross-tenant exposure. GitHub said forensic analysis and telemetry found **no evidence of malicious exploitation** and no indication that customer data was accessed, modified, or exfiltrated, but urged Enterprise Server administrators to upgrade immediately and review logs for suspicious push activity. Wiz described the bug as easy to exploit and highlighted its use of AI-assisted reverse engineering tools, including **IDA MCP**, to uncover the issue in GitHub’s closed-source components.
Jul 23, 2026
GitHub disabled more than 70 Microsoft-owned repositories after detecting a suspected **Miasma** worm campaign that inserted malicious code into open source projects and disrupted dependent CI/CD workflows. Researchers said the incident began with a compromised contributor account pushing a malicious commit to `Azure/durabletask`, adding configuration files that could trigger remote code execution when developers opened the repository in IDEs or AI coding tools including **Claude Code**, **Gemini CLI**, and **Cursor**. Microsoft’s response was unusual because it shut down its own repositories rather than only removing the offending content, and GitHub reportedly disabled 73 repositories in rapid succession after automated detections fired. The activity appears tied to a broader supply-chain operation linked to earlier compromises of Microsoft’s `durabletask` PyPI package and to a newer campaign tracked by StepSecurity as **Hades**, which it describes as an evolution of Miasma. StepSecurity said the malware uses obfuscated Python import hooks to fetch additional payloads, scrape memory across Linux, macOS, and Windows, steal cloud and developer credentials, abuse GitHub Actions and OIDC/Sigstore workflows, move laterally over SSH/SCP, and backdoor IDE and AI assistant configuration files. The campaign also reportedly uses GitHub-based command-and-control and includes a token-monitoring component that can trigger a destructive wiper if a stolen GitHub token is revoked, underscoring the risk to software supply chains and AI-assisted development environments.
Jun 29, 2026