Investigation update: GitHub Enterprise Server signing key rotation

May 26, 2026 : GitHub recently detected a cyber-attack and immediately activated our response process to investigate, disrupt malicious activity, mitigate the attack, and deny the threat actor further access. It’s important to note that this investigation is still ongoing, and we will continue to provide details as appropriate. Given the reality of threat actors and the advent of AI technologies, we need to do all we can to protect our customers. Considering the repositories that have been attacked and an abundance of caution, we are rotating keys, including the GitHub Enterprise Server signing key. This key is used to sign binaries for GitHub Enterprise Server to validate GitHub as the source during a manually initiated update process. All binaries hosted by GitHub are valid. GitHub Enterprise Server customers need to take immediate action as described below. No action is required for GitHub Enterprise Cloud. What customers need to do GitHub Enterprise Server administrators will need to rotate the GPG public keys in their instance. Admins can follow these instructions to do so using a GitHub developed script to streamline the process. If you’d like to independently verify the integrity of the script, its SHA256 digest is: 3009bf5cdef034e153008cc375a05ac0bdbb1a2a325b22adb300c028e3766b43 For single node topology , run these commands: $ curl -fsSL https://enterprise.github.com/security/2026-05-24/rotate-gpg.sh -o rotate-gpg.sh $ chmod ug+x ./rotate-gpg.sh $ ./rotate-gpg.sh $ sudo ./rotate-gpg.sh For HA or cluster topology : Log on to any node in your HA or cluster installation and run the following commands, they will download the script, copy it to all nodes and run it on all nodes: $ ghe-cluster-each -- curl -fsSL https://enterprise.github.com/security/2026-05-24/rotate-gpg.sh -o rotate-gpg.sh $ ghe-cluster-each -- chmod ug+x ./rotate-gpg.sh $ ghe-cluster-each -- ./rotate-gpg.sh $ ghe-cluster-each -- sudo ./rotate-gpg.sh Note that the key is stored in both the admin