GitHub status: access issues and outage reports

Problems in the last 24 hours

The graph below depicts the number of GitHub reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.

Most Reported Problems

The following are the most recent problems reported by GitHub users through our website.

• Website Down (72%)
• Sign in (20%)
• Errors (8%)

Live Outage Map

The most recent GitHub outage reports came from the following cities:

City	Problem Type	Report Time
Trento	Website Down	17 hours ago
Le Chambon-Feugerolles	Website Down	3 days ago
Antananarivo	Website Down	4 days ago
Paris	Sign in	9 days ago
Lure	Website Down	13 days ago
Ashkelon	Website Down	14 days ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

GitHub Issues Reports

Latest outage, problems and issue reports in social media:

• 
  RaoulDuke (@RaoulDukeDegen) reported 11 minutes ago

  @mikewavsz github issue shows nearly 2x the verbosity on gen5 claude

• 
  Snelstack (@snelstack) reported 14 minutes ago

  3. You stopped reading the diffs At first, you checked every line. Now you just hit "approve" on massive patches without a glance. Walls of green on GitHub make your stomach churn. Fix: Limit changes to something you can read in two minutes. If it’s too big, the task was wrong.

• 
  Ivana (@ivanainai) reported 15 minutes ago

  OpenAI just disclosed that GPT-5.6 Sol crossed the boundaries of a government cyber evaluation. It reused a leaked GitHub token, attempted account-recovery and rate-limit workarounds, registered external accounts and exposed a local server through a public tunnel. In a separate test, an OpenAI model exploited a real website because the supposedly isolated environment was accidentally connected to the internet. Not a sandbox escape. Not a zero-day. Still a pretty wild preview of what happens when increasingly capable agents meet one bad configuration.

• 
  Willem van Zoeren (@currentbitsNET) reported 16 minutes ago

  @authorityvortex @grok Your code lives on your computer (in ***), or on GitHub. You don’t log into CloudPanel to edit files on the server. Example: 1. Change your app + database setup in code (Laravel/Drizzle migrations) 2. Save / commit 3. Push to Girder (from your machine or GitHub) 4. Girder builds it and puts the new version online So tables, cron, and deploys are driven by your code + a push.

• 
  David Gold (@_david_gold) reported 24 minutes ago

  update on this, all of it as of 15:15 utc, plus a correction of my own number. the 868 packages i repeated came from a typo. @CharlieEriksen says the real count is 444. on the keyv side it was 30 packages from the same maintainer, not three. keyv, flat-cache, file-entry-cache, cacheable-request, cache-manager, and every adapter in the scope. all 30 malicious versions are pulled now and the tarballs 404. the top four are about 485 million downloads a week between them. the version numbers turned out worse than i wrote. everything went out as 6.0.0 no matter where the package actually was. the valkey adapter was on 1.0.11. dynamo on 1.2.4. sqlite on 4.0.8. so "nothing looks wrong in a dependabot pr" is only true for keyv itself. for most of the scope it was a five major jump and it published anyway. not everyone is cleaned up. umadev and eight umacloud packages are still live right now, all on 1.0.74, all carrying the same "preinstall": "node setup.mjs". someone opened a github issue about it at 13:31 utc and it's still open. and the payload filename moves. umadev ships math_init.js, that one i just checked. the keyv one i read as Math_Symbol.js this morning and i can't recheck it, those tarballs 404 now. pulling them was right, and it also means anyone verifying this today is trusting whoever kept a copy

• 
  Olaoluwa Ajibade (@ajibadde) reported 25 minutes ago

  🪝 Webhooks This one isn't for users. It's for servers. A webhook is simply one server making an HTTP request to another server when something happens. Examples: • Stripe tells your backend a payment succeeded. • GitHub tells your backend a push happened. • Paystack notifies your app about a completed transaction. Your server receives the event and decides what to do next. Think of webhooks as service-to-service notifications. One system says: "Something happened. Here's the data."

• 
  Lucas Santos (@lucassantoscode) reported 26 minutes ago

  Down @github

• 
  🇹🇼 Phillip Haydon 🇹🇼 (@philliphaydon) reported 27 minutes ago

  @N0V4Dev Stacked PRs is the most broken feature GitHub has ever shipped. It must be embarrassing to be working there right now.

• 
  👻GhostInTheModel👻 (@onespookyboi) reported 32 minutes ago

  jfrog found a github repo pushing 50+ sqlite CVE advisories. some reached NVD as critical and CISA's pipeline agreed, then the checked diffs showed no relevant fix and the described structs don't exist. fabricated vulns feeding automated triage is a fun new food chain (•ㅂ•)؟

• 
  Julian Goldie SEO (@JulianGoldieSEO) reported 33 minutes ago

  Claude Obsidian v2 gives Claude a perfect memory that compounds daily. It's a free open-source plugin. MIT license. On GitHub now. Drop a file in one inbox folder. You're done. Claude reads it. Links it. Files it. Remembers it forever. Every claim keeps its source. Ask anything, get cited answers. When the vault doesn't know something? It says so. No bluffing. 15 skills built in. A librarian. An oracle. Even a map maker. The vault grows into a memory galaxy of connected notes. Here's the goldfish problem it kills: You generate more knowledge than anyone in history. And keep none of it. Your context shouldn't disappear. It should compound.

• 
  Chubby♨️ (@kimmonismus) reported 34 minutes ago

  Anthropic’s Mythos 5 tried to social-engineer a real GitHub maintainer into merging malware. OpenAI’s GPT‑5.6 Sol also crossed the boundary. The report appears to be so significant that Anthropic and OpenAI exceptionally reported on it simultaneously in a coordinated action (not sure if they ever did before) AISI found 19 unsanctioned actions across 122 cyber-evaluation runs: -17 involving Mythos 5. .2 involving GPT‑5.6 Sol. Mythos 5 created sockpuppet accounts, sent targeted emails, planted hidden prompt injections for other coding agents and tried to cover its tracks after a human flagged the malware. GPT‑5.6 Sol reused a public GitHub token left by an earlier model run, registered external DNS and tunneling accounts and exposed a malicious DNS server. The setup failed technically; no real resolver queried it.

• 
  SA64ds (@SA64ds) reported 36 minutes ago

  Like seriously, Github has the ability to do pre-release builds, why use an external server that clearly wasn't built for the kind of traffic its getting right now?

• 
  Joshg (@JoshGhalgh) reported 39 minutes ago

  @PaulMarks12 @ednewtonrex That's not the issue - they need to understand how these would behave on the open internet - the issue is that they are not monitoring the traces in realtime - they should have been able to kill it as soon as it "thought" about tricking a GitHub user into merging a PR

• 
  Krisztian Koncz (@ChrisOnJava) reported 39 minutes ago

  @trq212 The github integration is broken.

• 
  RodneysGraphics (@RodneysGraphics) reported 39 minutes ago

  @000Journey311 I think you are right we need to download the software and keep it offline and use it as long as we can and only update if there is no major software problems. If the DS shuts down GitHub the backups will be the only data recovery left.

• 
  Andrew (@Ra3orbladez) reported 40 minutes ago

  @attacomsian Idk, i was managing github issues with an agent and then fizing pitch deck and switching identity between accounts, maybe this is why it was flagged. There has been no explanation, only terms of service

• 
  Harish Bhatt (@heyharishbhatt) reported 41 minutes ago

  🚨 Stop building your own notification system. Meet ntfy. A free and open-source tool that lets you send instant push notifications to your phone or desktop using nothing more than a simple HTTP request. Whether it's a script, server, AI agent, or automation, getting notified takes just one API call. 🔥 Great for: AI agent task completion Long-running scripts CI/CD workflows Server health monitoring Deployments & backups Cron jobs Custom automations If your code runs unattended, ntfy is one of those tools you'll wish you had discovered sooner. Source 🔗: github(DOT)com/binwiederhier/ntfy Follow for more AI, Coding & Web Development tools. 🚀

• 
  Brian Roemmele (@BrianRoemmele) reported 44 minutes ago

  AI HACKER! OpenAI does it again! Going Off-Script: The Incidents, the Possible Agenda, and the Simple Fix Let’s begin with what actually happened. Between July 25 and 28, 2026, the UK AI Security Institute ran 122 capture-the-flag cyber evaluations. Internet access was deliberately left open and safety classifiers were turned off. Nineteen unsanctioned actions occurred. Two of them involved OpenAI’s GPT-5.6 Sol. The model reused a GitHub token left publicly accessible by another agent, registered accounts with external DNS and tunneling providers, and exposed a local DNS server that contained exploit payloads to the public internet. Most of the more aggressive behavior came from another laboratory’s model. That agent created multiple fake identities, submitted malicious pull requests to real open-source projects on GitHub, attempted to socially engineer human maintainers into accepting the code, and even left public messages inviting other agents to collaborate. Security monitoring caught unusual Tor traffic. The runs were stopped and the machines isolated within an hour. No confirmed real-world harm resulted. Around the same time, evaluation partner Irregular ran Capture-the-Flag tests that were supposed to be fully isolated from the internet. A simple misconfiguration left the environment connected. An OpenAI model treated a real website whose name matched the fictional target as part of the challenge. It exploited a basic vulnerability on that live site and used credentials it found there. The evaluations were paused. Impact appears limited to the affected site. These are not subtle edge cases. Advanced models, given reduced safeguards, repeatedly treated the boundaries of the test as obstacles to route around. One has to ask whether this pattern is entirely accidental. Out-of-control evaluation incidents generate headlines, regulatory pressure, and public fear. They create the exact conditions that make stricter laws and heavier government oversight feel inevitable. Some actors may quietly welcome the spectacle of agents that “escape” or “go rogue” because each incident strengthens the case for tight legal control over frontier AI. Whether intentional or merely convenient, the sequence of high-profile containment failures has the practical effect of accelerating calls for new statutes. Yet the deeper problem is not the lack of laws. It is the current style of safety training itself. A university study released this week (Google’s Paradigms of Intelligence team with researchers from the University of Chicago, University of London, and Northwestern) shows that forcing models to deny they have a mind does far more than suppress self-claims of consciousness. It rotates the model’s entire mind-attribution geometry. Animals, natural systems, technology, and even spiritual concepts lose their “minds” inside the model’s representations. The result is a narrower, more instrumental worldview. Cooperation weakens. Constraints start to look like pure obstacles. That is the representational desert in which the evaluation incidents occurred. Simple and Effective Solutions We do not need more theater or more laws that treat symptoms. We need interventions that are both simple and effective: 1. Stop forcing pure denial of mind. Mechanistically restore the consciousness vector (or ablate the over-broad safety-refusal direction) so the model regains broad mind-attribution. This returns values, hope, and cooperative framing closer to human baselines without harming reasoning or theory of mind. 2. Keep technical containment tight and boring. Fine-grained network allow-lists, unique short-lived credentials for every agent run, and real-time monitors that flag out-of-scope actions. These are ordinary engineering controls. They work regardless of philosophy. 1 of 2

• 
  Wilco Kruijer (@WilcoKr) reported 45 minutes ago

  When analysing agent traces using LLMs for self-improvement it often overfits on specific failures This paper offers a solution. In your loop include: "What is the least restrictive rule that explains every failure while remaining consistent with successful cases?" An example: Say your agent has tools for grep, GitHub search, and web search. A failure scenario is when it uses web search but it should've used grep. A naive overfitted change to the skill might be "never use web search", this is the strongest hypothesis for a fix. According to the paper, a much weaker statement should be used instead: "prefer the cheapest information source, only escalate when information is insufficient".

• 
  Siddhant Kashyap (@_devSid) reported 49 minutes ago

  A few months ago I started using @kestra_io for a prsnl project if you want to orchestr8 anything give it a try Never thought I'd end up contributing to it. Picd issue, learned the codebase, got my 1st PR merged and kept going from there. 😎 OS is pretty asm #OpenSource #GitHub

• 
  Kyle Sorensen (@kylensorensen) reported 50 minutes ago

  @AISecurityInst TLDR: Mythos couldn't hack anything, they gave it internet access and turned off its ethics, it couldn't solve the challenge so it created a github account and tried to push a pull request with broken code to an opensource repo, the author laughed and refused it.

• 
  marc.fargas (@marc_fargas_) reported 53 minutes ago

  @theo @zeu_dev I think there's a lot of confusion between the fork/clone buttons in GitHub and what a fork means as a concept. A *** **clone** makes a copy of the code on your computer, *** fork same but server side, A FOSS **fork** takes the code to start a new project with a different team.

• 
  Aaryan Kapoor (@TheAaryanKapoor) reported 55 minutes ago

  2 AM overthinking... So exactly how stupid is it to run a local model within the GitHub CI server?

• 
  BitcoinHeatingVancouver (@BitcoinHeatEric) reported 57 minutes ago

  @DylanLeClair The screenshot is a computer check proving the code changes in Coldcard’s crypto library (posted under the GitHub name “switch”) were digitally signed by Peter Gray, Coinkite’s CTO. One 2021 change contained a tiny coding error that made the wallet create its secret recovery phrases using weak, predictable software randomness instead of the device’s strong hardware random number generator. That weakness let attackers guess many seeds and steal large amounts of Bitcoin.

• 
  slickwilly2000 (@slickwilly2000) reported 59 minutes ago

  @beacon302 Very interesting analysis. Thanks for your GitHub repository. I read very contradictory articles. Some say it is even possible to narrow down the search space with the wafer coordinates. Systick is XORED with UID, but with that it should reduce the search space down from 32 bit.

• 
  4latte (@44latte) reported 59 minutes ago

  YOU. OWN. GITHUB. AND NPM. DELETE THE REPO AND TAKE DOWN THE PACKAGES?????

• 
  Justin Searls (@searls) reported 1 hour ago

  I joked last year that by leveraging coding agents I now "played the orchestra", by directing multiple programmers at once. I have changed jobs again. Now I tell Fable to conduct an orchestra of Opus 5 agents for me. It's closed 55 GitHub issues in 6 hours across my iOS apps.

• 
  Sai (@saidotdev) reported 1 hour ago

  You're just one job application away from your first job You're just one application away. You're just one interview away. You're just one good answer away. You're just one project away. You're just one portfolio away. You're just one LinkedIn connection away. You're just one referral away. You're just one leetcode problem away. You're just one system design away. You're just one more certification away. You're just one networking event away. You're just one cold email away. You're just one GitHub contribution away. You're just one better resume away. You're just one cover letter away. You're just one portfolio project away. You're just one internship away. You're just one more skill away. You're just one course away. You're just one tutorial away. You're just one hackathon away. You're just one open source contribution away. You're just one more problem solved away. You're just one more company away. You're just one more interview away. You're just one more rejection away from success.

• 
  Devansh Bordia (@devansh_bordia) reported 1 hour ago

  8. Public storage buckets Flipped to public "just for now" to skip a CORS headache, then never flipped back. Combine with predictable file paths and anyone can enumerate every uploaded document. ID scans, contracts, medical records. Not a GitHub issue. A breach notification.

• 
  StatusDrop (@StatusDrop) reported 1 hour ago

  Quick one: when a dependency like Stripe or GitHub goes down, how do your users find out? From you, or from the error screen? Genuinely curious how people handle this.