Tag: gitlab
-
Over 1,000 GitLab servers vulnerable to ongoing RCE attacks
Tags: attack, data-breach, exploit, flaw, gitlab, Internet, rce, remote-code-execution, vulnerabilityOver 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/over-1-000-gitlab-servers-vulnerable-to-code-execution-attacks/
-
Alpine Linux rebuilds GitLab after attempted RCE attack
Tags: attack, exploit, gitlab, hacker, infrastructure, linux, open-source, password, rce, remote-code-execution, vulnerabilityHackers attempted to exploit a critical GitLab vulnerability in Alpine Linux’s development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/alpine-linux-rebuilds-gitlab-after-attempted-rce-attack/
-
CISA says max severity GitLab flaw now exploited in the wild
Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US Cybersecurity and Infrastructure Security Agency (CISA). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-now-exploiting-max-severity-gitlab-flaw-in-attacks/
-
CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229
The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that CVE-2026-97229, a critical vulnerability affecting both GitLab Community Edition and Enterprise Edition, is actively being exploited. On October 29, 2026, CISA added this flaw to its Known Exploited Vulnerabilities catalog, increasing the urgency for organizations running affected servers to take action. This vulnerability allows unauthenticated…
-
Angriff auf Ruby-Lücke: Alpine Linux muss Gitlab-Instanz komplett neu aufsetzen
Hacker haben versucht, über eine Ruby-Lücke die Gitlab-Instanz von Alpine Linux zu kompromittieren. Der Vorfall ist ein Weckruf an andere Gitlab-Admins. First seen on golem.de Jump to article: www.golem.de/news/angriff-auf-ruby-luecke-alpine-linux-muss-gitlab-instanz-komplett-neu-aufsetzen-2610-214676.html
-
Angriff auf Ruby-Lücke: Alpine Linux muss Gitlab-Instanz komplett neu aufsetzen
Hacker haben versucht, über eine Ruby-Lücke die Gitlab-Instanz von Alpine Linux zu kompromittieren. Der Vorfall ist ein Weckruf an andere Gitlab-Admins. First seen on golem.de Jump to article: www.golem.de/news/angriff-auf-ruby-luecke-alpine-linux-muss-gitlab-instanz-komplett-neu-aufsetzen-2610-214676.html
-
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
Tags: cisa, cisco, cve, cybersecurity, dos, exploit, firewall, flaw, gitlab, infrastructure, kev, rce, remote-code-execution, software, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.The vulnerabilities are listed below – CVE-2026-97229 (CVSS score: 10.0) – An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise First seen on…
-
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
Tags: cisa, cisco, cve, cybersecurity, dos, exploit, firewall, flaw, gitlab, infrastructure, kev, rce, remote-code-execution, software, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.The vulnerabilities are listed below – CVE-2026-97229 (CVSS score: 10.0) – An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise First seen on…
-
Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project’s own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October.The flaw, CVE-2026-97229 (CVSS score: 10.0), can let an attacker run code on a GitLab server through a crafted regular expression in a CI configuration. Alpine…
-
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month.GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution…
-
Schadcode-Attacken möglich: 12 Jahre alte Lücke gefährdet Gitlab-Server
Administratoren sollten dringend ihre Gitlab-Instanzen aktualisieren. Eine seit 2014 bestehende Lücke lässt Angreifer eigenen Code einschleusen. First seen on golem.de Jump to article: www.golem.de/news/schadcode-attacken-moeglich-12-jahre-alte-luecke-gefaehrdet-gitlab-server-2610-214419.html
-
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That’s a lot to deal with in just a few days. And the week isn’t even over yet.But those big…
-
GitLab warns of new max severity code execution vulnerability
GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/
-
GitLab Patches Critical 10.0 RCE Vulnerability Allowing Unauthenticated Remote Code Execution
GitLab has released emergency security updates to address a critical remote code execution vulnerability that could allow unauthenticated attackers to execute arbitrary code on affected servers. This flaw, tracked as CVE-2026-110264, carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company published the patches on October 21,…
-
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2…
-
12 Best CI/CD Pipeline Security Tools Compared (2026): Features Pricing
Your CI platform’s native controls (GitHub Advanced Security, GitLab Ultimate) are the baseline, Cycode and Legit lead dedicated pipeline posture, and StepSecurity owns the runner-hardening niche attackers actually exploit. Twelve options across native, dedicated, hardening, and platform-absorbed lanes because the factory is now the target. Quick Verdict: Best CI/CD Security at a Glance “¢ Native…
-
GitLab Patches Max-Severity Vulnerability CVE-2026-97229
GitLab fixed a critical vulnerability with a maximum CVSS score of 10.0 that could let unauthenticated attackers run code on its servers. GitLab has addressed a critical security flaw, tracked as CVE-2026-97229 (CVSS score of 10.0), that could let attackers run code on its servers without logging in. The flaw affects Community Edition (CE) and…
-
GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)
GitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that could allow remote attackers … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/13/gitlab-ci-cd-regular-expression-compiler-vulnerability-cve-2026-97229/
-
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution.”GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in…
-
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution.”GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in…
-
Critical GitLab Vulnerability Allows Unauthenticated Attackers to Execute Remote Code
GitLab has released emergency security updates to address a critical vulnerability that could allow unauthenticated attackers to execute arbitrary code on affected servers. This vulnerability, tracked as CVE-2026-97229, has been assigned the highest CVSS score of 10.0 and impacts both GitLab Community Edition and Enterprise Edition. On October 12, 2026, the company released versions 19.4.2,…
-
GitLab fixes critical vulnerability that exposed software environments to sabotage
The company urged customers to upgrade to the latest versions of its flagship products. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/gitlab-vulnerability-remote-code-execution/832736/
-
GitLab fixes serious vulnerability that exposed software environments to sabotage
The company urged customers to upgrade to the latest versions of its flagship products. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/gitlab-vulnerability-remote-code-execution/832736/
-
GitLab warns of max severity code execution vulnerability
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/
-
Security Affairs newsletter Round 598 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Fake Zoom installer hides macOS backdoor CloudSyncD CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed Antino Backdoor Lets…
-
CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed
GitLab fixes critical AI Gateway flaw that could let authenticated Duo users escape a prompt sandbox and execute commands on self-hosted gateways. GitLab has released patches for a critical vulnerability in its AI Gateway, tracked as CVE-2026-90970 (CVSS score of 9.9), that could allow an authenticated user with access to the Duo Agent Platform to…
-
CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed
GitLab fixes critical AI Gateway flaw that could let authenticated Duo users escape a prompt sandbox and execute commands on self-hosted gateways. GitLab has released patches for a critical vulnerability in its AI Gateway, tracked as CVE-2026-90970 (CVSS score of 9.9), that could allow an authenticated user with access to the Duo Agent Platform to…
-
Critical GitLab AI Gateway Flaw Lets Attackers Execute Arbitrary Commands
GitLab has issued emergency security updates for a critical vulnerability in its Self-Hosted AI Gateway that could allow authenticated attackers to execute arbitrary commands on vulnerable AI Gateway deployments. The flaw, tracked as CVE-2026-90970, carries a CVSS severity score of 9.9 out of 10. The company released GitLab AI Gateway versions 19.2.4, 19.3.2, and 19.4.1…
-
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers
A critical flaw in GitLab’s AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory.The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own gateway need to act. The flaw…
-
GitLab warns of critical RCE vulnerability in AI Gateway service
GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-rce-vulnerability-in-ai-gateway-service/