GitHub rotates Enterprise Server signing key after breach investigation

GitHub has rotated the signing key used for GitHub Enterprise Server (GHES) binaries after detecting a cyber-attack. The company says its investigation is ongoing and that it is rotating keys "including the GitHub Enterprise Server signing key" out of caution. All binaries currently hosted by GitHub remain valid, according to the company.

The key in question is used to sign GHES binaries so that GitHub can be validated as the source during a manually initiated update process. The rotation means that GHES administrators must update the GPG public keys on their instances before future patches and releases—which will be signed with the new key—can be installed. GitHub Enterprise Cloud customers are not affected and need to take no action.

How to rotate the key

GitHub has published a script to streamline the rotation process. Administrators who want to verify the integrity of the script independently can check its SHA256 digest:

3009bf5cdef034e153008cc375a05ac0bdbb1a2a325b22adb300c028e3766b43

For single node topologies, run the following commands:

$ curl -fsSL https://enterprise.github.com/security/2026-05-24/rotate-gpg.sh -o rotate-gpg.sh   
$ chmod ug+x ./rotate-gpg.sh  
$ ./rotate-gpg.sh  
$ sudo ./rotate-gpg.sh

For HA or cluster topologies, log on to any node in the installation and run the following commands. They will download the script, copy it to all nodes, and run it on all nodes:

$ ghe-cluster-each -- curl -fsSL https://enterprise.github.com/security/2026-05-24/rotate-gpg.sh -o rotate-gpg.sh  
$ ghe-cluster-each -- chmod ug+x ./rotate-gpg.sh   
$ ghe-cluster-each -- ./rotate-gpg.sh  
$ ghe-cluster-each -- sudo ./rotate-gpg.sh

Note that the key is stored in both the admin and root accounts. Running the script a second time with sudo ensures the key is updated in both locations.

If the signing key is not rotated, GHES version upgrades will fail verification with the following error message:

Error: The file provided is not a valid GitHub Enterprise Server package.

GitHub advises customers to download GHES updates only from the official GitHub.com source URL and recommends preparing to apply security updates at an increased rate in the coming months.

Incident background

The key rotation follows the detection on May 18 of a compromise of an employee device involving a poisoned VS Code extension published by a third party. GitHub removed the malicious extension version, isolated the endpoint, and began incident response immediately.

The company's current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker's claim of roughly 3,800 repositories is "directionally consistent" with GitHub's investigation so far. GitHub says it has no evidence of impact to customer information stored outside its internal repositories, though some internal repositories do contain customer information such as excerpts of support interactions. If any such impact is discovered, GitHub says it will notify affected customers through established channels.

Critical secrets were rotated Monday and into Tuesday, with the highest-impact credentials prioritized first. GitHub continues to analyze logs, validate secret rotation, and monitor its infrastructure for follow-on activity. A fuller report is expected once the investigation is complete.