GitHub is facing HUGE problems!

Highlights

• A critical remote code execution vulnerability on github.com allowed unauthorized access to private repositories through unprivileged git push commands.

• GitHub merge queues experienced a logic error on April 23, 2026, that dropped data and created invalid commits in project Git histories.

• Automated traffic from AI-generated code has caused a massive surge in pull requests, commits, and repository creations throughout 2026.

• GitHub is currently scaling its infrastructure to 30x capacity while migrating from a monolithic architecture to Microsoft Azure microservices.

• Open source maintainers face burnout due to an asymmetry where AI agents generate issues and pull requests faster than humans can review them.

• Following the resignation of Thomas Domke in August 2025, GitHub operates without a dedicated CEO under Microsoft's Core AI division.

Timeline

1. 00:00 - 03:49

   Critical remote code execution vulnerability

   Security company Viz discovered the vulnerability, which functioned without the need for phishing or account takeovers. It specifically abused the way GitHub handled extra metadata attached to push requests. Although GitHub reported the issue as fixed with no known damage, the breach highlights a fundamental failure in input sanitization for a core Git feature.

   • A security vulnerability allowed arbitrary code execution on GitHub servers via the standard git push option feature.
   • The flaw resided in unhandled metadata within the xstat header that failed sanitization during the authentication process.
   • Successful exploitation provided unrestricted access to private repositories regardless of the user's specific push permissions.
2. 03:50 - 07:51

   Merge queue failures and service instability

   The April 23 incident involving merge queues caused significant delays for large teams who rely on intermediate merges to work faster. Because the errors appeared as internal logic bugs, developers spent hours troubleshooting their own code before identifying GitHub as the source of the corruption. Independent monitoring services suggest that GitHub's official status page underreports the frequency of minor but disruptive incidents.

   • Internal logic errors in the merge queue feature resulted in broken repository states and the loss of Git history in commits.
   • Third-party tracking indicates GitHub's actual uptime falls significantly below the industry standard of 'three nines' (99.9%).
   • The platform has transitioned into an unreliable state for professional CI/CD workflows and collaborative development.
3. 07:52 - 12:25

   AI-driven traffic surge and infrastructure migration

   GitHub attributes recent instability to a massive increase in code being pushed by users employing AI tools. Internal charts show a steep upward trend starting in late 2025 and accelerating into 2026. This surge hit while engineers were already tasked with breaking up a monolithic structure, requiring them to stabilize a legacy system under heavy load while building its replacement.

   • Traffic metrics for pull requests and new repositories skyrocketed in early 2026 due to AI-assisted coding.
   • Infrastructure demands forced GitHub to revise its capacity expansion goals from 10x to 30x within a four-month window.
   • The platform is struggling to maintain stability while simultaneously migrating from legacy data centers to Azure microservices.
4. 12:26 - 16:51

   Structural shift toward AI-centric development

   The departure of Thomas Domke in August 2025 marked a turning point where GitHub lost its independent leadership. Microsoft now integrates Copilot into every aspect of the platform, including 'Agent HQ' for browser-based coding. This move aligns with a broader corporate strategy but creates a mismatch for developers who prioritize core repository management and CI/CD over generative AI features.

   • GitHub no longer has a dedicated CEO and resides within Microsoft’s Core AI division.
   • Strategic focus has shifted from being a general developer platform to an AI-powered toolchain centered on Copilot.
   • New features prioritize AI interaction within the web interface over traditional local IDE workflows.
5. 16:52 - 23:13

   The open source review crisis and future outlook

   The philosophy of open source is under threat because GitHub makes it too easy to submit AI-generated contributions. Maintainers are forced to choose between ignoring the community or facing total burnout from reviewing automated pull requests. While some projects are leaving, most companies stay because the cost of migration is higher than the current pain of instability, though improvements in reliability are expected by late 2026.

   • Asymmetric workloads allow AI to generate low-quality 'slop' issues faster than human maintainers can review them.
   • Individual projects like SIG have begun migrating to alternatives such as Codeberg to escape the AI-driven noise.
   • Enterprise users remain locked into the ecosystem despite reliability issues due to a lack of feature-equivalent competitors.