CVE-2026-3854 allowed any authenticated user to compromise GitHub backend servers via injected git push options, exposing millions of private repositories.…