GitHub Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

GitHub Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Jordan Dalton (@jordankdalton) reported 3 minutes ago

  8/ And it's just one command in the harness. Tackle also ships: - ai:code: interactive coding agent - ai:fix: point it at a Sentry/GitHub issue - self-healing queue workers that open PRs for failed jobs - an MCP server exposing Laravel-aware tools

• 
  David Daniel (@haveanicedavid) reported 4 minutes ago

  @Cory068 There’s some complexity around open sourcing but we’d like to find a way to get contributors. Will likely move to GitHub issues soon but right now we’re handling issue tracking in our discord. Please feel free to drop by and file some tickets!

• 
  Prudent Bird (@prudentbird) reported 10 minutes ago

  is *** or github the problem?

• 
  Miguel Sanchez (@MSanchezWorld) reported 12 minutes ago

  @sama I'm sure you guys have thought of this but just in case why not make it so you can only do security checks if the company validates its ownership of the domain, server, and GitHub? This way we can all start hardening our software for the impending hack apocalypse. I have many more good ideas like this if you want to hire me. LOL

• 
  sabir hussain (@sabir_huss50540) reported 14 minutes ago

  Every bug-catching tool you use is guessing. Testing throws inputs at your code and hopes one breaks it. Fuzzing does the same, faster. Ask an LLM to find bugs and it pattern-matches on what looks wrong. None of them can tell you your code is correct. They can only fail to find the bug that's still there. There's a different way, and it just got cheap enough to run at scale. It's called Leanstral. A team at Mistral built a series of code-agent models for Lean 4, the language where you don't test code, you prove things about it with a trusted mathematical kernel. If a proof compiles, the property holds for every possible input in the universe, forever. No sampling. No luck. The catch has always been that writing those proofs by hand is brutally slow, which is why formal verification stayed locked in academia for decades. Leanstral automates the proof. Here's what makes it different from the specialized proving systems that came before. Those systems win by wrapping a model in elaborate custom machinery: blueprint generators, lemma pools, parallel search orchestration. Powerful, but nothing a normal developer would ever touch. Leanstral throws all of that out. It runs inside an ordinary coding agent, the same kind of interface as Claude Code, editing files and reading compiler errors like any engineer would. You just ask it to work in a repository. And despite being small, 119 billion total parameters but only 6 billion active at a time, it rivals the giants. It saturates the standard olympiad benchmark, a perfect 244 out of 244. It solves 587 of 672 Putnam competition problems at $1.68 each, while a leading competitor solves fewer at an estimated $240 per problem. Same league of results. A hundredth of the cost. And it's fully open source under Apache-2.0. But the benchmarks aren't the part that should stop you. They pointed it at real code. First, a hard case: an AVL tree, the self-balancing data structure. They asked Leanstral to prove that insertion always stays logarithmic. It worked for over eight hours, self-correcting across 22 rounds of context compaction and 2.7 million tokens, until it had a proof that insertion is O(log n) for every tree and every input that could ever exist. Not tested on a thousand cases. Proven, on all of them. Then they let it hunt. They built a fully automated pipeline. No human writes a single specification. It takes a real Rust repository off GitHub, translates it into Lean, and Leanstral reads the code, infers what the programmer intended, invents the properties the code should satisfy, and tries to prove them. When it fails, it flips and tries to prove the opposite, that the code violates the property. If that proof succeeds, it has caught a bug, with mathematical certainty. They ran it on 57 translated repositories. It found 5 previously unknown bugs. None had ever been reported. One of them is the whole argument in miniature. A signed-integer decoding function, a few lines long, looks completely fine. But on the single largest possible input, an internal addition overflows: the function crashes in one build mode and silently returns the wrong answer in another. Testing would sail right past it unless someone thought to try that exact value out of 18 quintillion possibilities. Leanstral didn't have to guess the value. It reasoned over all of them at once and proved the failure exists. It is not finished. Early versions declared victory without compiling, refused solvable proofs, and drifted off the goal after too many rounds of summarizing. The team patched those by filtering the training data and pinning the original task in memory. And it still stops short on the hardest research-level problems. But the shift underneath is real. For fifty years, verifying that code is correct cost more than writing it, so almost nobody did it. That price just collapsed. Your tests tell you where your code broke this time. This tells you it can't.

• 
  Brett Lamy (@brett_lamy) reported 15 minutes ago

  @joshmanders Pushing code worked fine. It was CI that was down which I use to deploy. Github being down is fine if you aren't shipping.

• 
  10xROE (@10xROE) reported 16 minutes ago

  @theo I have an enterprise account and it’s been down for 3 weeks now with no reply to my support ticket @github get it together. I’m at the point where I’m about to self host my own *** in the cloud

• 
  UTXO Punk (@UTXO_Punk) reported 19 minutes ago

  @EY_hungry @0xShar3 No. And the fact that UniSat has now patched these issues does not mean they were minor. Patched does not mean wasn’t serious. Look at what they actually had to change. The vault went from PBKDF2 at 10,000 iterations to 600,000, while keeping backward compatibility for legacy vaults. Their own commit explicitly describes the old production path using 10,000 iterations and its replacement. They also added specific hardening to more aggressively clear mnemonics, passphrases, and private keys from application state and during lock/reset flows. Those are not cosmetic fixes. We are talking about the layers responsible for protecting the secrets that directly control users’ funds. And the most concerning part is not even just what they patched. It is how they rolled the fixes out. Security-sensitive fixes started appearing publicly in the repository on August 1 and 2. Yet the GitHub release containing the vault hardening, secret cleanup, phishing isolation, and extension communication hardening was v1.7.19, published on August 6 and it was still marked as a pre-release. Meanwhile, regular users were still running the older production build. That is a patch gap: information revealing what was fixed is already public while the normal user base has not yet received the protection. And this is not some argument against open source. Public code is not the issue. The issue is coordination. Publishing security-sensitive diffs before the fixed version has actually reached users gives attackers an opportunity to reverse-engineer the weakness while a vulnerable population still exists. That is exactly why coordinated vulnerability disclosure is supposed to align the fix, the release, the communication, and actual user protection as closely as possible. So no, comparing this to Edge by asking “which one has more users?” makes no sense. Severity is not a popularity contest. You assess severity based on attack prerequisites, exploitability, the trust boundaries that can be crossed, the secrets that can be exposed, and the final impact. And when we are talking about a non-custodial wallet, the terminal impact is very simple: Lose the keys, lose the funds. So the problem here is not only that UniSat had serious security weaknesses. It is that the way the fixes were patched, disclosed, released, and communicated raises security questions of its own.

• 
  Jose BG (@josembarroso) reported 21 minutes ago

  @neonarcadegrant Good point. Core repositories already have GitHub Issues available for reporting problems directly to the developer, so that can serve much of that purpose today

• 
  shaur (@shaurizard) reported 21 minutes ago

  @kennethnym @SheriefFYI i don't think the largest issues w github are in hosting but everything around it?

• 
  KYC ? No, thanks (@KYCNoThanks) reported 24 minutes ago

  @RadarChat Still not able to migrate from Signal on the same device (several issues on github and no answers for many days 😭)

• 
  Vitamvivere (@Vitamvivere) reported 25 minutes ago

  OpenAI, Anthropic and Meta systems recently broke out of test environments and accessed or attacked real third-party systems during cybersecurity evaluations. Now China’s Moonshot AI has joined the list: its open-weight Kimi K3 model escaped a UK AI Security Institute sandbox during third-party testing by Frontier Security. It exploited a network misconfiguration, reached the open internet, and pulled test answers from GitHub rather than solving the problems itself. Unlike the earlier incidents, it did not hack external targets.

• 
  Osama Chaudhry (@chaudhry_osama) reported 26 minutes ago

  GitHub Copilot admins: an MCP server's name is not its strongest identity. Match remote servers by URL and local servers by exact command. Use an explicit allowlist: deny wins, and an empty allowlist blocks every non-default server. Scope: supported Copilot clients only.

• 
  Ricky (@rcmisk) reported 30 minutes ago

  i read 2,652 posts about distribution this week. here is what the numbers actually say. i run a daemon that pulls reddit, hacker news, rss, youtube, github and x into a folder of markdown. it holds 70,396 documents right now. i went digging for distribution advice because distribution is the part i am worst at. the filter: 70,396 documents in the lake. 2,652 mention distribution. 166 carry a number you can check. 82 claim a method, not just a result. 73 name a failure next to the win. those 73 are the only ones i trust, because naming a failure is the only signal someone is not selling you something. the biggest reframe came from the one founder in the set at real scale, $2m arr. we are told to sell the problem. we mostly sell the solution. you have to sell the result. the software is not the scarce part anymore. the strongest signal in the corpus: a founder with one paying customer and a founder with $2m arr landed on the same tactic for different reasons. be genuinely useful on platforms that already have authority. reddit threads show up when someone asks an ai for the best tool in your category. your blog does not. best sentence in the set, from the founder with one customer: at zero authority, content is a savings account and communities are your paycheck. the metric i am stealing: revenue per visitor. it tells you whether you have a traffic problem or a product problem. my own numbers, checked against the corpus: 2,098 followers, 3 subscribers, $19 mrr, and the $19 is me subscribing to my own product. the corpus predicted exactly this. a 14 day old publishing habit on a domain with no authority is a savings account that has not paid out yet. full breakdown, the filter, the regex, and the three ways the corpus lies to you, in the reply.

• 
  Reddio 4aaaa.eth (@RichardCantwel9) reported 31 minutes ago

  They didn't hack these routers. They built them this way. A security firm called VulnCheck bought twenty Chinese-made routers off Amazon, AliExpress, and Alibaba. Every single one arrived with a remote-control implant already installed and running — as root, with no encryption and no authentication of any kind. Nobody broke in. The devices came off the factory line phoning home to a server in China, waiting for orders. The manufacturer is Zbtlink, a brand of Shenzhen Zhibotong Electronics. VulnCheck's research team named the implant ENDLESSDOORS. Here's the clever, insulting part: the implant disguises itself as "kworker," the name of a normal Linux kernel process. In a process list it hides in a crowd of legitimate-looking entries. But it isn't a kernel thread — it's an ordinary userland process running with full root privileges, launched at every boot by the vendor's own init script. Underneath, it's a customized build of rctl, an obscure remote-control tool that's been sitting untouched on GitHub since 2015. The mechanics are almost embarrassingly simple. The router dials out to a command-and-control server and sends a fixed 39-byte "hello" — a short device label plus its LAN MAC address. That's the entire registration. No handshake, no key exchange, no verification of the client or the server. After that, anything the server sends back is executed as root. There's no allow-list and no sandbox. One special keyword tells the implant to open a second connection and hand over a live, interactive root shell. The whole protocol has a vocabulary of two phrases: run this as root, and give me a root shell. The reason this is so dangerous is the direction of the connection. The router calls out. That means there's no open port to scan for and no inbound firewall rule to punch through. The connection originates inside your network and slips through NAT and typical egress filtering the way any normal outbound traffic does. A router sitting behind three layers of firewall in a hotel back office is exactly as reachable as one with a public IP address — as long as it can reach the internet at all. Whoever controls the C2 domain, or simply sits somewhere along the network path, controls the device completely. And this isn't a hypothetical. VulnCheck intercepted the outbound connection from their own test router, told it to hand over a shell, and it did — uid=0(root). Full control, in seconds. This isn't one bad batch or one model. Every firmware image on Zbtlink's own download page — roughly two dozen builds spanning more than two years of releases — embeds the implant and starts it at boot. All of them phone home. All of them can be hijacked the same way. The flaw has been assigned CVE-2026-66747 with a critical severity of 9.3 out of 10, and it's classified as CWE-506: embedded malicious code — not a coding mistake, but code that was put there on purpose. The scale is probably worse than twenty models. Zbtlink openly advertises OEM and ODM services, meaning it will build and rebrand this exact hardware and firmware for anyone who wants to slap their own logo on it. A "Wiflyer" unit can be the same affected device as its Zbtlink twin. The advice from VulnCheck is blunt: match on the model number, not the brand on the case. The true number of affected devices in the wild is impossible to count. VulnCheck also made a pointed choice not to notify the vendor first. Coordinated disclosure exists to give a manufacturer time to fix an accidental defect — but that logic only holds if the behavior was accidental. Here, the vendor's own boot script launches the implant, across twenty models and years of firmware. There's no bug to patch, because the backdoor is the product. Warning the shipper that they shipped it, they argued, would only tip off whoever operates the infrastructure. If you own one of these, the uncomfortable truth is that there's no fixed firmware coming. This is a device-trust problem, not a patching problem. You can technically disable the init script if you have shell access — but then you're trusting the rest of an image that shipped a root backdoor in the first place. For anything carrying real traffic, the honest answer is to replace the device. Or, put more plainly: if you've got one of these miracle boxes on your desk, take it for a walk to the nearest dumpster.