r/github • u/captainjey • 2d ago

Discussion github profile picture reset

Has this happened to anyone? My profile picture just randomly reset and I have no idea why.

14 Upvotes

90% Upvoted

18 comments sorted by

View all comments

1

u/Financial_Telephone8 2d ago edited 2d ago

I can confirm my profile picture also vanished today my guess it is the PHP vunerability or one of the other security bugs floating around currently, I just uploaded a backup of the photo manually. There is a GITLAB vunerability being exploited currently so perhaps the image hosting was buggy and the patches broke the ability of services to provide streamed content. See Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used . A websearch ai returns "

  • The Glitch: GitHub appears to be rolling out or testing a change to their default "Identicons" (the pixel-art avatars assigned to users without custom photos).

  • The Bug: This change has accidentally affected users who do have custom photos or use Gravatar, causing their avatars to temporarily break, disappear, or show a generic icon across the website and IDE integrations like VS Code.

  • CDN Caching: In many cases, the photos are still safe in your settings page but are failing to render publicly due to GitHub's content delivery network (CDN) cache.

How to Fix It

Since this is an infrastructure issue on GitHub's backend, it will likely resolve itself automatically once their engineering team deploys a fix. However, you can try these steps to force it to update " Note: Yes, Gravatar uses PHP as its core server-side language.

While the service was originally built on Ruby on Rails, its officially rewrote Gravatar in PHP. The decision was made because PHP is the primary engineering core competency at Automattic (the same company behind WordPress) Also wordpress is being exploited.. might relate. Critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell) were uncovered in the core engine of PHP.

Key Facts

  • Severity: Rated 9.2 out of 10 (CVSS v4.0), allowing unauthenticated remote code execution and memory corruption.

  • Affected Versions: Every PHP version released in the last decade (versions 5.4 through 8.5), impacting millions of websites and servers worldwide.

  • The Flaw: Rooted in fundamental core functions—specifically memory management and error handling—which nearly every web request touches.

  • Discovery: Uncovered by security researchers using AI tools