Wiz security researchers found a critical remote code execution vulnerability (CVE-2026-3854) in GitHub Enterprise Server that could be exploited with a single malicious git push command, allowing attackers to execute code on GitHub's backend infrastructure. GitHub confirmed the finding in its official security response and credited Wiz with responsible disclosure. The claim about 'every customer environment' slightly overstates scope — the vulnerability affects GHES instances and authenticated users on the platform, but GitHub's public response suggests the company patched before widespread exploitation occurred.