GitLab

It is freaking everywhere.

Also, the next day, so the same day as Bratly, we got a GitLab level 10 CVE.

Level 10.

Out did us.

Which is, by the way, we can pwn your GitLab.

Which turned out to be a Ruby level 10 CVE in the regex parser.

So the regex parser could explode and then you can do some memory fiddling and basically now you own Ruby as well.

So this is all Railway's forensic read, and it wasn't confirmed attribution to a known group.

But Railway did work with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, Stripe, and a lot of others to revoke keys.

So it notified those vendors on October 21st.

Then public disclosure came out 11 hours later.

California school records were hacked.

Railway got compromised, GitLab had a 10 out of 10 severity hole, JavaScript had vulnerabilities, Signal had minor vulnerabilities, and even Medi-Cal records were hacked as well.

My favorite one, even Tor had relays hijacked to steal logins.

Most people don't even know that Japan declared a cybersecurity emergency right ahead of all this.

Of course, website operators still need to install those updates to stay protected.

Another major security flaw was discovered in GitLab.

This is a very popular platform that developers use to store code, collaborate on projects, and deploy software.

And this one was a pretty big deal.

It received a severity rating of 10 out of 10, which is the highest possible score.

Basically, hackers could potentially run malicious code on vulnerable GitLab servers without even logging in.

And since these servers can contain sensitive source code and credentials, the consequences could be pretty serious.

Fortunately, there haven't been any confirmed widespread attacks associated with this vulnerability, and GitLab has already released a patch.

And something that happened, or two things actually, but one big huge thing that happened...

the week ending October the 23rd and so we do want to make sure that you're up to date so please go check out the blog and hopefully you will learn and of course we'll be talking about this in the coming days what happened because that's going to be a big huge thing but this item we're going to talk about is uh patching gitlab ce slash e max severity flaw and the bug by the way that you will need to patch is for the week ending the 23rd also is a maximum severity bug.

which is why I'm mentioning it in this file, even though I'm not going to go into a lot of detail about it here, because this newsletter doesn't cover this.

This newsletter will not cover this particular item.

This one allows an unauthenticated attacker to execute arbitrary code on the GitLab server by using a specially crafted regular expression to exploit insufficient regular expression validation In a CI slash CD configuration, GitLab credits...

This is a joke scar for reporting the flaw.

Through the company's bug bounty program with HackerOne, three high severity flaws affect both GitLab CE and EE, a cross-site scripting issue allowing arbitrary JavaScript execution, CVE-2026-92883, an improper authorization issue allowing unauthorized execution of CI-CD pipelines, CVE-2026-16301, and a permissive regular expression issue that could cause targeted CI slash CD pipelines to execute specially crafted content and could lead to exposure of protected environment variables CVE 2026 14 8 14 The other two high-severity flaws affect just GitLab EE, an incorrect authorization issue allowing unauthenticated arbitrary execution of a transferred project's CI-CD pipelines with the new group's privileges CVE-2026-81839, and improper neutralization of inputs for LLM prompting that could cause unintended command execution attributed to other users.

in the GitLab Duo agent platform CVE-2026-96893.

Forecasters interpret this wave of attacks as the predictable consequences of growing publicly available AI cyber capabilities.

Affected targets and vulnerabilities include PHP, Node.js, Jinx, GitLab, and a variety of institutions, including 400 Latin American financial institutions, an Indian certificate authority, a Japanese internet services provider, California's public school system, and Meta's Muse, among others.

Of these, the most notable were two critical zero-day vulnerabilities in PHP, an open-source language used in frameworks like WordPress, and therefore perhaps in approximately 70% of all websites globally.

A patch was available at the time of announcement, but millions of attacks attempted to exploit the vulnerabilities as attackers raced against defenders in what some in cybersecurity are referring to as Black October.

Okay, that can count.

And it is one of our things at GitLab.

So, you go.

You go.

Capcom confirmed a breach exposing 11.7 million email addresses.

GitLab, LiteLLM, blah, blah, blah, and on and on and on.

Chaos, chaos, cyber attacks everywhere.

Okay, so that was about a week ago, a little less than a week ago, four days ago even.