Patch applies fake diffs from commit messages

A critical supply chain vulnerability exists where attackers can embed malicious code into Git commit messages that gets executed when patches are downloaded and applied using standard tools like wget/curl with GNU patch, potentially injecting unauthorized files or modifications into codebases without detection in GitHub's UI. This affects common patch distribution workflows across organizations and requires immediate review of patch handling procedures, especially in automated deployment and CI/CD pipelines. IT teams must evaluate whether their patch management practices use vulnerable tool combinations and implement controls to validate patch authenticity and content.