GitHub issues $100,000 bounty for critical RCE vulnerability disclosed by @sagitz_
The researcher disclosed CVE‑2026‑3854, a critical RCE flaw, prompting the largest payout in GitHub's Vulnerability Reward Program to date.
By Ryan Merket · Published
Primary source: X
Why it matters
A six‑figure GitHub bounty for a critical RCE bug highlights the escalating stakes of supply‑chain security and signals that major platform operators are willing to invest heavily to close high‑impact vulnerabilities before they can be weaponized.
In a post on X on July 22nd, security researcher Saif Ghani (@sagitz_) announced that GitHub Security had paid a $100,000 bounty for the discovery of a remote‑code‑execution (RCE) vulnerability now catalogued as CVE‑2026‑3854. The bounty, confirmed by a thank‑you tweet from the official GitHub Security (@GitHubSecurity) account, represents one of the largest single rewards the company has issued through its Vulnerability Reward Program.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.