Posts Tagged ‘gitlab’
GitLab Path Traversal Vulnerability: Patch Now
A critical GitLab path traversal vulnerability, CVE-2026-85706 (CVSS 10.0), lets an unauthenticated attacker read any file off a self-managed GitLab server, including credentials, deploy keys, and CI/CD configuration. GitLab shipped a patch on September 10; CISA added the flaw to its Known Exploited Vulnerabilities catalog the next day, and BSI issued its own warning on…
Read MoreTop 5 Cybersecurity News
This week’s Top 5 Cybersecurity News keeps returning to the same uncomfortable pattern: the systems under attack are not the ones organizations watch closely, they’re the ones organizations trust by default. Identity platforms, remote-support tools, developer infrastructure, and mobile devices all exist specifically so that legitimate work can move faster and with less friction. This…
Read MoreGitLab GraphQL code injection vulnerability
A GitLab GraphQL code injection vulnerability is now under active exploitation, reproduced and attacked within minutes of GitLab’s August 17, 2026 disclosure of CVE-2026-19478. The unauthenticated flaw (CVSS 9.4) lets an attacker delete public projects, forge fake fix records, or lock out maintainers on any unpatched self-managed GitLab instance. GitLab.com and GitLab Dedicated were already…
Read MoreGitLab Oj Spill RCE Exploit Goes Public
The GitLab Oj Spill RCE is now public: a working exploit chain and full technical writeup were released on July 24 for a remote-code-execution flaw that GitLab quietly patched six weeks earlier, on June 10. If your self-managed GitLab instance is still on 18.10.7 or older, any developer who can push a commit can now…
Read More