Wiz Research disclosed CVE-2026-3854 yesterday after a coordinated disclosure process that began on March 4, 2026. The vulnerability exists in GitHub's internal git infrastructure, specifically in how its internal babeld git proxy handles user-supplied push option values. During a git push operation, any string passed via the push option flag is included verbatim in an internal semicolon-delimited X-Stat header. Because the semicolon is also used as the header's field delimiter, a crafted push option value can inject additional metadata fields that downstream services treat as trusted internal configuration. The practical impact is severe. Any authenticated GitHub user with push access to any repository can execute arbitrary commands on the backend server processing the push. On GitHub.com, because the git service runs in a shared multi-tenant environment, successful exploitation gave access to the shared storage node. Wiz confirmed they could read repositories from organizations they had no relationship with. The blast radius is effectively every repository hosted on the same backend node. GitHub received the report on March 4 and patched GitHub.com within 75 minutes of that report. Public disclosure was held until April 28 to allow GitHub Enterprise Server customers to patch. At time of disclosure, Wiz data showed 88% of GHES instances remained on vulnerable versions.

A pre-authentication SQL injection vulnerability in LiteLLM, the widely deployed open-source proxy that centralizes API routing across multiple LLM providers, was actively exploited within 36 hours of public disclosure. LiteLLM acts as a unified gateway for enterprises connecting applications to models from OpenAI, Anthropic, AWS Bedrock, and others. It stores upstream provider API keys, virtual API keys for internal billing, and proxy runtime configuration in a PostgreSQL database. The vulnerability exists in the Authorization Bearer header handling during proxy API key verification. The query mixes caller-supplied input directly into the query text rather than using parameterized queries. An unauthenticated attacker sending a crafted Authorization header to any LLM API route, including POST /chat/completions, can inject arbitrary SQL before authentication completes. The patch was included in version 1.83.7 released April 19. The vulnerability was indexed in the GitHub Advisory Database on April 24. The first exploitation attempt was recorded April 26 at 16:17 UTC, 36 hours and 7 minutes later. Sysdig documented the exploitation behavior in detail. The attacker was not running automated SQL injection tooling. They knew LiteLLM's internal database schema verbatim, referencing table and column names precisely, including litellm_credentials.credential_values and litellm_config. They ran targeted column enumeration against three specific tables that hold provider credentials and rotated between two adjacent IP addresses to reduce detection. This is a skilled operator who had already studied the target before the vulnerability was even disclosed.

CISA added CVE-2024-1709, a critical authentication bypass in ConnectWise ScreenConnect, to the Known Exploited Vulnerabilities catalog today with a federal remediation deadline of May 15. ScreenConnect is a remote monitoring and management platform used by managed service providers and IT teams, comparable in deployment profile to SimpleHelp, which was added to KEV in Issue 13. The authentication bypass allows an unauthenticated attacker to create a new administrator account on unpatched instances by sending a crafted request to the setup wizard endpoint. Once the account is created, the attacker has full RMM access to every managed endpoint connected through that instance. ConnectWise patched this vulnerability in February 2024 and it was widely exploited at that time. The KEV addition today reflects confirmed renewed active exploitation, not the original 2024 campaign.