Akinsira-Olumide Ifedayo Olympicson

Senior Software Engineer

[Akinsira-Olumide Ifedayo Olympicson @DjangoWiz]

CVE-2026-3854: one git push, full shell on GitHub's backend.

CVSS 8.7. Free account was enough.

Reported March 4, 2026. Patched in 6 hours. 88% of GHES still vulnerable at disclosure.

A thread.

[Akinsira-Olumide Ifedayo Olympicson @DjangoWiz]

@sagitz_ @github https://t.co/6tefy0lMQW

[Akinsira-Olumide Ifedayo Olympicson @DjangoWiz]

CVE-2026-3854: one git push, full shell on GitHub's backend.

CVSS 8.7. Free account was enough.

Reported March 4, 2026. Patched in 6 hours. 88% of GHES still vulnerable at disclosure.

A thread.

[Akinsira-Olumide Ifedayo Olympicson @DjangoWiz]

The lesson.

No crypto bug. No exotic syscall. A missing sanitizer on a semicolon, where user input flowed into an internal header.

Closed binaries are no longer a defence.

Follow @DjangoWiz for more.

[Akinsira-Olumide Ifedayo Olympicson @DjangoWiz]

CVE-2026-3854: one git push, full shell on GitHub's backend.

CVSS 8.7. Free account was enough.

Reported March 4, 2026. Patched in 6 hours. 88% of GHES still vulnerable at disclosure.

A thread.

[Akinsira-Olumide Ifedayo Olympicson @DjangoWiz]

8/ What to do.

GHES: patch now. 88% of instances were still vulnerable at disclosure. Assume yours is until you check.

https://t.co/OkZXFgWf17 only: nothing required, but rotating long-lived personal access tokens is cheap insurance.

[Akinsira-Olumide Ifedayo Olympicson @DjangoWiz]

@vitddnv MRR

[Akinsira-Olumide Ifedayo Olympicson @DjangoWiz]

@iamrjknight @elonmusk I sincerely doubt Solomon was richer than Elon 😂

Do you know what 700billion dollars is?

You need to make 39,000 dollars every hour since the time of Jesus Christ till today to have 700 billion dollars .

That's 657 dollars per minute or 10.9 dollar per second. Since 0 BC

[Akinsira-Olumide Ifedayo Olympicson @DjangoWiz]

@vivaangandhi_ @grok what was used to create this?

[Akinsira-Olumide Ifedayo Olympicson @DjangoWiz]

@ShahidA99580 Agent

[Akinsira-Olumide Ifedayo Olympicson @DjangoWiz]

@elonmusk Is there like a summary we can just follow so we know exactly how to hack the algorithm in our favour?

[Akinsira-Olumide Ifedayo Olympicson @DjangoWiz]

@eyad_khrais This really helped a lot. Thank you friend!

Has anyone actually tried the Claude max X20? Is it actually worth it?

[Akinsira-Olumide Ifedayo Olympicson @DjangoWiz]

@ai_uncovered FILE

[Akinsira-Olumide Ifedayo Olympicson @DjangoWiz]

@TommiPedruzzi START