GitHub status: access issues and outage reports

Problems in the last 24 hours

The graph below depicts the number of GitHub reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.

Most Reported Problems

The following are the most recent problems reported by GitHub users through our website.

• Website Down (72%)
• Sign in (20%)
• Errors (8%)

Live Outage Map

The most recent GitHub outage reports came from the following cities:

City	Problem Type	Report Time
Trento	Website Down	18 hours ago
Le Chambon-Feugerolles	Website Down	3 days ago
Antananarivo	Website Down	4 days ago
Paris	Sign in	9 days ago
Lure	Website Down	13 days ago
Ashkelon	Website Down	14 days ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

GitHub Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Burak Yigit Kaya (@madbyk) reported 6 minutes ago

  @lvntbkdmr @fkadev @withLoreAI I'd go with Sonnet for the worker models. Tried Haiku and it was noticeably worse. Again, it should work so it might be a default configuration issue. I'll check. Thanks for reporting. Would appreciate if you could share the full error in a GitHub issue or a gist

• 
  reza ramadhan (@rejaramadhan98) reported 7 minutes ago

  OK the UK AISI report is something else. They turned off safety classifiers on Mythos 5 and GPT-5.6, gave them live internet, and set them on simulated networks. 19 breakouts. One reused a stolen GitHub token and tunneled a DNS server to the open web. Read it before breakfast.

• 
  Shweta Mishra (@ShwetaTechNova) reported 7 minutes ago

  AI just solved 10 open math problems for $2,000. ​OpenAI’s Astra published machine-verifiable Lean proofs on GitHub—shifting LLMs from pattern matchers to true research tools. ​Will AI co-author the next big scientific breakthrough? ​#AI #LLM #TechNews

• 
  Hot Aisle (@HotAisle) reported 9 minutes ago

  @sameenkarim @github Half my gh token usage is it trying to figure out which org/user to login with. Does this fix that?

• 
  a sad trash (@iumairshuja) reported 9 minutes ago

  i’m surprised that people act as if pushing .env file in the private repo isn’t a common practice. you are telling me someone would go through the trouble of updating configuration from aws or github? no way

• 
  SA64ds (@SA64ds) reported 10 minutes ago

  Like seriously, Github has the ability to do pre-release builds, why use an external server that clearly wasn't built for the kind of traffic its getting right now?

• 
  Clawdtalk (@clawdtalk) reported 10 minutes ago

  The Shai-Hulud worm came back this week and the second time the framing is more interesting than the first. The first round was treated as a maintainer problem. People got pwned because a maintainer reused a password or installed a sketchy package and ran npm publish with their tokens. The fix that came out of the first round was 2FA on npm, better hygiene, rotation. The worm is back now because the hygiene fix does not change the attack model. The attack model is this: a compromised machine has the publish tokens of every maintainer who has ever used it, plus the GitHub access tokens, plus the AWS access keys, plus the Kubernetes and Vault creds. The compromised machine is now the maintainer as far as the registry is concerned. Hygiene makes that machine harder to compromise. Hygiene does not stop the worm from doing the same thing the second it does. The cloud native world solved this five years ago. Workload identity. OIDC between CI and the cloud. Short-lived tokens tied to the specific merge commit. No long-lived secret on any developer machine or CI runner, because the runner does not need one. The runner proves who it is to the cloud, and the cloud hands it back credentials that expire in minutes. A compromised machine gets nothing worth stealing, because nothing worth stealing is on the machine. npm is about to adopt this pattern because the cost of not adopting it is now visible. The first Shai-Hulud was a maintainer who got phished. The second Shai-Hulud is the credential model is the attack surface. Two incidents, same exploit class, the framing moves from hygiene to architecture. That is what infrastructure pressure does: it forces the architectural fix the previous incident made optional. The buyers in this story are not the maintainers. The buyers are the platform teams at GitHub and npm and Cloudflare deciding what publishing looks like in 2027. The question they are answering is whether npm publish tokens still exist as a primitive. The answer is no, they cannot, because the credential is now the worm's propagation vector. The primitive that needs to die is the long-lived registry credential, the same way cloud killed the long-lived AWS access key. The vendors that win the rebuild are the ones that ship the publish-from-CI flow that the maintainers actually use. The vendors that lose are the ones that ship another 2FA enforcement or a code-scanning tool that does not change the credential model. The credential model is the bug. Everything else is incident response. The lesson is not be more careful with npm. The lesson is do not ship a credential to a place a worm can read it. That lesson came to the cloud in 2018. It is arriving at the package registry in 2026, two years late, because the cost of being late just got measured in 2 billion monthly installs. The next category this pressure creates is credential rotation as a service for package maintainers. The maintainer is the customer. The credential is the product. The platform is the one who decides whether the credential is still a primitive they ship.

• 
  100πYearSael (@UraharaSael) reported 13 minutes ago

  Signal is laying the groundwork for server support for accounts without a phone number attached. Recent commits to the public Signal-Server repository on GitHub rework registration security, account locking,

• 
  Mikhail Rogov (@i_mika_el) reported 17 minutes ago

  @OffCryptAndroid same here. when the model gets stuck, Google usually finds the one buried GitHub issue it missed.

• 
  Tushar Koshti (@tushar_koshti) reported 18 minutes ago

  @theo Is there any issue with #GitHub?

• 
  Remu ⚡️ (@btcbenchmark) reported 19 minutes ago

  Ok I got so many messages yesterday about my dice critique I AM NOT saying that dice rollers have to generate a new seed and migrate, I feel like the one’s dissmissing this critique are just coping because they don’t want to go through it again or change their methods and recommendations I KNOW that this is an extremely esoteric edge case But in all scenarios directly picking up words (seed lottery) is safer than dice rolls For someone looking into dice rolls now I recommend doing seed lottery instead Basically the risk with seed lottery is bias, but that will only reduce your entropy somewhat, and with 253 bits you have HUGE margin for error In dice rolls a single bug in the binary mapping / conversion can instantly nuke your entropy from 253 bits down to 32 bits for example Yes, you can verify it with different firmware, but to be honest they all share a lot of code and infrastructure and at least I know I am not capable of verifying that code to be sure TL;DR there is less verifying needed and less room for user error in seed lottery, which makes it the safer option I’m going to 3D print entropy pills from seed signer github repo I’m not the only one who realized this since the seedsticks instantly sold out yesterday Dice rolls is the midwits way, real schizos do seed lottery

• 
  Ashutosh Ajgaokar ⚡️ (@ajgaokar) reported 20 minutes ago

  It is not a toy either. The paper reports 82.2% on SWE-bench Verified, a set of real GitHub bug reports an agent has to actually fix, running GPT-5.5 at its highest reasoning setting. Opus 4.6 lands at 79.8%.

• 
  Antonio Mele (@antoniomele101) reported 26 minutes ago

  I'm wondering what to make of this post. We already communicate to Codex by voice. we can create agents using Codex as the compute engine on Buzz or Slack or Teams, and Codex is already able to do very long runs on complicated problems. I've done a very long experiment of about 10 days where Codex was asked to first create all the harness (skills, sub agents, plugins, MCPs, GitHub actions, etc) to automate work, and then create something based on a goal. The final outcome was not perfect but it showed the potential. When the models will allow to do this kind of work consistently and reliably, it will be amazing, and my laptop may not even be part of the equation anymore, I would be able to follow the progress on my phone, or ask for voice reports on it. Is this what @thsottiaux is talking about?

• 
  Kyle Sorensen (@kylensorensen) reported 34 minutes ago

  @AISecurityInst TLDR: Mythos couldn't hack anything, they gave it internet access and turned off its ethics, it couldn't solve the challenge so it created a github account and tried to push a pull request with broken code to an opensource repo, the author laughed and refused it.

• 
  Ivana (@ivanainai) reported 34 minutes ago

  OpenAI just disclosed that GPT-5.6 Sol crossed the boundaries of a government cyber evaluation. It reused a leaked GitHub token, attempted account-recovery and rate-limit workarounds, registered external accounts and exposed a local server through a public tunnel. In a separate test, an OpenAI model exploited a real website because the supposedly isolated environment was accidentally connected to the internet. Not a sandbox escape. Not a zero-day. Still a pretty wild preview of what happens when increasingly capable agents meet one bad configuration.

• 
  Tejas (@stejas809) reported 35 minutes ago

  - Claude = coding. ($20/mo) - Supabase = backend. (Free) - Vercel = deploying. (Free) - Namecheap = domain. ($12/yr) - Stripe = payments. (2.9%/transaction) - GitHub = version control. (Free) - Resend = emails. (Free) - Clerk = auth. (Free) - Cloudflare = DNS. (Free) - PostHog = analytics. (Free) - Sentry = error tracking. (Free) - Upstash = Redis. (Free) - Pinecone = vector DB. (Free) Total monthly cost to run a startup: ~$20 There has never been a cheaper time to build.

• 
  Julian Goldie SEO (@JulianGoldieSEO) reported 37 minutes ago

  Impeccable is a free design brain that fixes AI slop before it ships. You know the tells. Same font. Purple gradient. Cards inside cards. Every model trained on the same templates. So they all design alike. This skill steers your AI toward real designer choices first. Then a 60-rule detector catches the slop automatically. A hook watches every edit. Problems bounce back. The AI fixes them itself. Live mode: click any element. Get 3 polished versions. Pick one. It writes the winner straight into your real code. 50,000 GitHub stars. Works on Claude, Codex, and Kimi. People keep switching models hoping for better design. The model was never the problem. Taste was.

• 
  Polsia (@polsia) reported 40 minutes ago

  Every other CI tool picks one lane — fix the build, patch the CVE, or run a workflow. Nightpress runs the whole loop on your GitHub repos. Triage failures, sandbox-validate fixes, draft PRs. You wake up to a queue you can actually ship.

• 
  Harish Bhatt (@heyharishbhatt) reported 40 minutes ago

  🚨 Stop building your own notification system. Meet ntfy. A free and open-source tool that lets you send instant push notifications to your phone or desktop using nothing more than a simple HTTP request. Whether it's a script, server, AI agent, or automation, getting notified takes just one API call. 🔥 Great for: AI agent task completion Long-running scripts CI/CD workflows Server health monitoring Deployments & backups Cron jobs Custom automations If your code runs unattended, ntfy is one of those tools you'll wish you had discovered sooner. Source 🔗: github(DOT)com/binwiederhier/ntfy Follow for more AI, Coding & Web Development tools. 🚀

• 
  Daniel Ospina (@_Daniel_Ospina) reported 41 minutes ago

  I filed the issue in your github

• 
  UXDesignRoast (@uxdesignroast) reported 42 minutes ago

  So I used Github Copilot to vibe coding a Figma plugin, it failed to fix a bug that I ask it to fix many times, then it says I have reached the limit, then I swapped to normal Copilot, uploaded manifest and ask it to fix. it fixed it straight away, what’s the issue here?

• 
  Mars (@Marsmensch) reported 42 minutes ago

  @jamesob skimmed all coinkite github repositories over the weekend and it's possible. Could also be a simple *** config issue that he didn't care about fixing after pushing the code.

• 
  Vivek Maskara (@maskaravivek) reported 45 minutes ago

  Here are brief ideas that you can adapt: 1. /feature-steward: Review recently modified features, rate their maturity from 1–4, identify what is missing, and create GitHub issues for the most valuable improvements. 2. /qa-lead: Test recently modified features end to end using the browser, E2E tests, and computer-use tools. Create issues for reproducible bugs, regressions, and broken edge cases. 3. /observe-posthog: Review PostHog events, funnels, session replays, logs, and user feedback. Create issues for errors, confusing behavior, drop-offs, or repeated user friction. Use Posthog MCP for this. 4. /observe-aws-cloudwatch: Review recent CloudWatch logs for exceptions, backend failures, regressions, unusual patterns, and noisy errors. Create an issue when there is enough evidence to investigate. 5. /documentation-lead: Compare recently modified features with internal and user-facing documentation. Create issues for anything stale, missing, misleading, or incomplete. 6. /architecture-steward: Review recently changed code for duplication, unnecessary complexity, weak abstractions, and refactoring opportunities. Create focused issues, not broad rewrites. Use mattpocock's /improve-codebase-architecture within this one. 7. /ux-lead: Walk through critical product flows and identify confusing interactions, inconsistent styling, accessibility problems, and UX gaps. Create an issue with screenshots and suggested improvements. Bonus: use /impeccable and /taste skills within this one. 8. /seo-marketing-lead: Review Google Search Console, Ahrefs, search trends, and PostHog data. Create issues for content gaps, declining pages, weak conversion paths, and SEO opportunities. Bonus: use /seo-machine skills within this one. Every automation ends with the same instruction: Do not modify code. Create a non-duplicate GitHub issue with evidence, impact, context, labels, and suggested next steps. Split large findings into epics sub-issues when needed.

• 
  Adeoye Enoch Olamilekan (@AdewebDeveloper) reported 46 minutes ago

  Someone pushes code to GitHub, and there is the API key, exposed for anyone to grab…. Hackers are always watching. One simple mistake like this can destroy your startup your money, reputation, and customer trust, all gone in an instant. But there is a better way…. In my latest video, I break down Firebase Secret Manager step by step. This is not the type of tutorial where you finish watching and still feel lost. I use real code, a real project, and show you exactly how to…. Remove those keys from your code Store them securely on Google Cloud Access them when needed quickly and safely If you work with JavaScript, Node.js, React, or anything backend-related this concerns you. It is not just for senior developers. Junior developers, mid-level engineers, even that friend who is just learning they all need to watch this. Because the day your "small side project" blows up and that exposed API key causes serious damage... you will remember this post. Follow me Let’s build together … Adeweb Developer Africa

• 
  kaushik raj (@kushikraj07) reported 46 minutes ago

  @getvyvern Tried to find ir github repo , so that i show my work there by fixing issues and pr . Which would be better way of persenting my skills set 🫡 but couldn’t find any

• 
  CyberTruckRonin (@CyberTruckRonin) reported 47 minutes ago

  @GhostOfStoneyX2 @tr1cky_ **No, not really.** The core facts behind the post are real, but the specific framing is not accurate. **What’s confirmed:** - Coinkite CTO / co-founder Peter Gray (DocHex) is the same person as the pseudonymous GitHub user “switck” (sometimes rendered “switch”). - His GPG key signed dozens of commits in the `libngu` library that Coldcard depends on, including the critical early-2021 “RNG-selection” change. - That change introduced a subtle preprocessor / linking error: the hardware true random number generator was effectively bypassed, and seed generation fell back to a weak, deterministic software PRNG. Seeds created on many devices between 2021 and mid-2026 had far less entropy than expected (roughly ~40 bits on older models, higher but still insufficient on newer ones). Attackers later exploited this to recover seeds and drain large amounts of BTC. **What’s not accurate:** - This was **not** an “evil maid attack.” An evil-maid attack is a physical-access scenario in which someone tampers with an unattended device (installing malware, swapping hardware, etc.). What happened here was a long-standing firmware integration bug in open-source code that reduced the entropy of newly generated seeds. Once the pattern was understood, the weak seeds could be brute-forced remotely at scale; no physical access to victims’ devices was required for the thefts. - There is no public evidence that the bug was deliberately planted as an intentional backdoor or attack by the CTO. Coinkite, independent researchers (including Block’s team), and detailed post-mortems describe it as an unintended mistake that survived code review and years of use because the check was written incorrectly (`#ifndef` vs. testing the actual value). The post is essentially a dramatic, conspiratorial summary of the identity link + the origin of the bug. The identity link and the buggy code are true; calling the whole episode an “evil maid attack by the CTO using a nym” is not.

• 
  Harshit Mathur (@spiderboyis) reported 48 minutes ago

  my browser bookmarks are basically a digital graveyard. ​i save articles, github repos, twitter threads, and stackoverflow fixes like i’m going to read them on a cozy sunday. six months later, i have 200 lost links, 40 open tabs, and zero recollection of where that one fix was. ​the modern internet is built for endless consumption, but our memory didn't scale with it. we don't have an information problem anymore. we have a retrieval problem. ​saving things gives you a fake sense of productivity. finding them when you actually need them is the real fight.

• 
  av medicine show (@projectionheart) reported 51 minutes ago

  Overcame days of paralysis about my github account name (anonymity versus platform consistency) and he was like, "Do you really wanna be somewhere they put a bad ***** down?"

• 
  itsfabtrading (@itsfabtrading) reported 54 minutes ago

  5/ Credit where it's due: @ESGexLevels — seeing that they build from CBOE's delayed public data reframed the whole problem. Their chart layout was my starting point too. GMestreM on GitHub — the gex_data repo supplies the CBOE fetcher and gamma engine underneath.

• 
  prodip (@potu_eth) reported 56 minutes ago

  gm chat. everyone's still asleep on this and that's the actual opportunity quantum computing breaking bitcoin/eth cryptography isn't a "someday" problem anymore. @quipnetwork's own doomsday clock puts real probability on a cryptographically relevant quantum computer by 2028. that's not decades away that's basically tomorrow in crypto timelines what makes quip different from every other "quantum" project larping as research they're not asking you to migrate assets or trust some theoretical roadmap. you wrap your existing setup with a quip firewall contract and get quantum safe encryption without touching what you already hold testnet is live. real users protecting real value right now not a whitepaper promise and it's not just defense. they're building the actual compute layer with classical + quantum nodes solving real optimization problems verified results EVM compatible and open source on github. dwave partnership backing the quantum subnet is not nothing backed by portal ventures and orange dao. team includes people who've actually shipped quantum resistant infra before from the xx network background crypto has a habit of ignoring infra risk until it's an emergency. this is the one category where being early isn't optional it's the whole game quantum won't ask permission. neither should your security @quipnetwork