{"id":96242,"date":"2026-05-20T14:07:38","date_gmt":"2026-05-20T21:07:38","guid":{"rendered":"https:\/\/github.blog\/?p=96242"},"modified":"2026-05-26T15:49:08","modified_gmt":"2026-05-26T22:49:08","slug":"investigating-unauthorized-access-to-githubs-internal-repositories","status":"publish","type":"post","link":"https:\/\/github.blog\/security\/investigating-unauthorized-access-to-githubs-internal-repositories\/","title":{"rendered":"Investigation update: GitHub Enterprise Server signing key rotation"},"content":{"rendered":"\n

May 26, 2026<\/strong>: GitHub recently detected a cyber-attack and immediately activated our response process to investigate, disrupt malicious activity, mitigate the attack, and deny the threat actor further access. It’s important to note that this investigation is still ongoing, and we will continue to provide details as appropriate.<\/p>\n\n\n\n

Given the reality of threat actors and the advent of AI technologies, we need to do all we can to protect our customers. Considering the repositories that have been attacked and an abundance of caution, we are rotating keys, including the GitHub Enterprise Server signing key. This key is used to sign binaries for GitHub Enterprise Server to validate GitHub as the source during a manually initiated update process. All binaries hosted by GitHub are valid.<\/p>\n\n\n\n

GitHub Enterprise Server customers need to take immediate action as described below. No action is required for GitHub Enterprise Cloud.<\/p>\n\n\n\n

What customers need to do<\/h2>\n\n\n\n

GitHub Enterprise Server administrators will need to rotate the GPG public keys in their instance. Admins can follow these instructions to do so using a GitHub developed script to streamline the process. If you’d like to independently verify the integrity of the script, its SHA256 digest is:<\/p>\n\n\n

\n
3009bf5cdef034e153008cc375a05ac0bdbb1a2a325b22adb300c028e3766b43<\/code><\/pre>\n<\/path><\/path><\/svg><\/path><\/svg><\/clipboard-copy><\/div>\n\n\n
For single node topology<\/strong>, run these commands:<\/p>\n\n\n
\n
$ curl -fsSL https:\/\/enterprise.github.com\/security\/2026-05-24\/rotate-gpg.sh -o rotate-gpg.sh   \n$ chmod ug+x .\/rotate-gpg.sh  \n$ .\/rotate-gpg.sh  \n$ sudo .\/rotate-gpg.sh <\/code><\/pre>\n<\/path><\/path><\/svg><\/path><\/svg><\/clipboard-copy><\/div>\n\n\n
For HA or cluster topology<\/strong>:<\/p>\n\n\n\n