CVE-2026-97229 is an integer overflow in Onigmo, the regex engine built into Ruby, which GitLab uses to compile CI/CD config regexes. A crafted regex can run code on the server without authentication. GitLab scored it 10.0 and says it works "under certain conditions", without saying which.

Fixed in GitLab 19.2.8, 19.3.5 and 19.4.2, released Oct 12. Affected: self-managed CE/EE 19.2.0-19.2.7, 19.3.0-19.3.4, 19.4.0-19.4.1. GitLab.com and Dedicated are already patched.

CISA added it to KEV on Oct 29 with a due date of Nov 1. Rapid7 published a working PoC on Oct 13. Censys counted about 25,766 hosts on affected versions in mid-October.

The catch is in Alpine Linux's post-mortem from Oct 28. Alpine was attacked on Oct 20-21 after it had already upgraded GitLab, and the upgrade did not help. GitLab's patch fixes the Ruby bundled in its own omnibus and CNG packages. Alpine runs GitLab on a system Ruby, so the vulnerable engine was still there. Source installs and distro packages have the same problem.

Those installs need Ruby updated separately: 3.3.13 or 3.4.12 (released Oct 23), or 4.0.8 or later in the 4.0 series. Ruby issued no CVE of its own for this, so scanners report it under the GitLab number.

Check both the GitLab version and the Ruby version before calling an instance patched.

Sources: GitLab critical patch release 19.4.2 / 19.3.5 / 19.2.8 (Oct 12); CISA KEV entry for CVE-2026-97229 (added Oct 29, due Nov 1); Alpine Linux post-mortem (Oct 28); Rapid7 analysis and PoC (Oct 13); Ruby 3.3.13 / 3.4.12 release notes (Oct 23).

If you run self-managed GitLab CE/EE, patch now. A crafted CI/CD config lets someone run code on the server without logging in. It's being actively exploited, and CISA added it to KEV on 29 Oct. Fixed versions are 19.4.2, 19.3.5 and 19.2.8. GitLab.com is already patched. Check your version under Admin > Dashboard and upgrade to the fixed release for your branch.

If you run self-managed GitLab, patch today. On October 21 GitLab fixed CVE-2026-110264, rated 10/10. It allows unauthenticated remote code execution. The bug affects every version since 7.0. There is no workaround, so upgrading is the only mitigation. GitLab.com is already patched.

This is a second critical bug in the same component

GitLab shipped two out-of-band critical releases this month. Both bugs are in the pattern-matching code, but they are different issues:

|Date|CVE|Score|Fixed in| |:-|:-|:-|:-| |Oct 12|CVE-2026-97229|10/10|19.4.2, 19.2.8 and others| |Oct 21|CVE-2026-110264|10/10|19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13|

If you updated after the Oct 12 release and stopped there, you are still vulnerable. The Oct 21 release fixes 11 vulnerabilities in total (1 critical, the rest high/medium/low).

What the bug is

An integer overflow in the pattern-matching code. A crafted pattern makes an internal length counter wrap to a small value, so a too-small buffer gets allocated, and then the data written into it overflows into adjacent memory. According to the researchers, it can be triggered through a crafted file that GitLab renders in the browser. No credentials needed.

Affected versions and fixes

|Your version|Upgrade to| |:-|:-| |19.5.0|19.5.1| |19.4.0 – 19.4.2|19.4.3| |19.3.0 – 19.3.5|19.3.6| |19.2.0 – 19.2.8|19.2.9| |19.1.0 – 19.1.8|19.1.9| |19.0.0 – 19.0.9|19.0.10| |18.11.0 – 18.11.12|18.11.13| |18.10 and older|no direct fix, upgrade to at least 18.11.13 via the upgrade path|

GitLab normally backports fixes to the last three minor versions only. This time they patched four older ones as well, which says something about the severity. As of Oct 22 there were no confirmed attacks, but details are public, and mass scanning usually follows quickly.

1. Check your version

sudo gitlab-rake gitlab:env:info | grep -A2 "GitLab information" # or cat /opt/gitlab/embedded/service/gitlab-rails/VERSION # Docker docker exec -it gitlab cat /opt/gitlab/embedded/service/gitlab-rails/VERSION

You can also check /help in the web UI (you need to be logged in).

2. Back up first

sudo gitlab-backup create sudo cp /etc/gitlab/gitlab.rb /etc/gitlab/gitlab-secrets.json ~/

The backup does not include gitlab.rb and gitlab-secrets.json, and you can’t restore properly without them. Store all of it off the server.

3. Upgrade within your own minor branch

Go to the fixed version of your current branch (e.g. 19.4.1 → 19.4.3) rather than jumping to the latest. Expect downtime from a few minutes to \~30 min.

Debian/Ubuntu:

sudo apt update sudo apt install gitlab-ce=19.4.3-ce.0

RHEL-like:

sudo dnf install gitlab-ce-19.4.3

Docker (image: gitlab/gitlab-ce:19.4.3-ce.0 in compose):

docker compose pull docker compose up -d

Use gitlab-ee if you run EE. Substitute your own target version.

4. Verify

sudo gitlab-rake gitlab:check SANITIZE=true

Then confirm the version again and check that projects and pipelines work.

If you’re on 18.10 or older

You can’t skip required upgrade stops. Use GitLab’s official Upgrade Path tool, enter your current and target version (18.11.13 or newer), and follow every stop in order. Take a backup before each step. On very old instances this can take hours, so rehearse on a clone first.

Worth keeping in mind: GitLab holds your source code, CI/CD variables and often deploy credentials, so a compromise here means more than just the one box.

Official details are in GitLab’s security release announcement for Oct 21.

[MEGATHREAD] PHP2Shell (CVE-2026-109618/109619), LiteLLM, eMudhra, GitLab & Other October Security Incidents AKA Black October

We've been getting hammered with posts and questions about the wave of vulnerabilities, compromises, and other security incidents over the past week. A lot are duplicative, and there is a wave of vibe coded crap getting shared that doesn't really do much in this situation. Rather than having a 3 dozen threads covering the same thing, we're going to consolidate the general discussion.

There's a lot happening, and some of it more serious than others. There's also a fair amount of speculation and outright BS getting mixed in with legitimate reporting.

For anyone trying to catch up, here are the most significant incidents / vulns and links to official sources. We'll add more as needed.

What's going on?

PHP2Shell (CVE-2026-109618 / CVE-2026-109619)

Critical PHP vulnerabilities with reported exploitation attempts predating public disclosure. Emergency security updates were released October 21.

- PHP official releases - CISA advisory

LiteLLM supply chain compromise

Malicious packages published through PyPI and container registries. Potential credential theft and remote code execution.

- LiteLLM official incident report

eMudhra certificate authority compromise

Compromised certificate infrastructure created the potential for forged trusted certificates. Google and Mozilla have both published responses.

- Google security response - Mozilla security response

GitLab critical vulnerabilities

Emergency security updates for affected self-managed GitLab installations.

- GitLab security release

Railway and Zeabur security incidents

Both platforms have disclosed security incidents affecting their infrastructure and services.

- Railway security disclosure - Zeabur incident report

Other useful resources

- CISA Known Exploited Vulnerabilities Catalog - NIST National Vulnerability Database - CISA Cybersecurity Advisories

A few things worth mentioning

If you have new research, technical findings, or a significant development, feel free to create a separate post. Otherwise, please keep chatter and questions here.

Please link original sources when possible. We're particularly interested in technical findings, incident reports, and official advisories rather than another article summarizing someone else's reporting.

If we've missed something significant, drop it in the comments with a source and we'll update the thread.

Last updated: October 23, 2026.

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a readapi-scoped token to retrieve a project's incoming email address and create work items, bypassing the token's restrictions, due to insufficient scope enforcement on a GraphQL field.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API.

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the identity provider's control, due to incomplete enforcement of the membership lock on requests created before the lock was enabled.

GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egress to a third-party service for that group and its descendant projects, due to insufficient granularity of the admin-lock enforcement controls.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have read the confidential issue's title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers.

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to improper cleanup logic that failed to distinguish between pre-existing records from newly created ones during error handling.

End of life: 1/21/2027, End of support: 11/19/2026, Latest version: 19.5.3

October 12–13 | Cybersecurity | CRITICAL

GitLab released security updates addressing CVE-2026-97229, a vulnerability with the maximum CVSS severity score of 10.0.

The vulnerability affects GitLab's CI/CD regular-expression compiler.

Under certain conditions, an unauthenticated attacker could submit specially crafted configuration data that results in arbitrary code execution on a vulnerable GitLab server.

The issue affects self-managed Community Edition and Enterprise Edition installations.

GitLab released fixes for the affected version branches and strongly recommends immediate upgrades.

GitLab's hosted service has already been patched.

Researchers have not established widespread exploitation of this vulnerability in the wild.

Status: CONFIRMED — Vendor security advisory and published technical reporting.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to download package files from a public project due to improper authorization checks.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with reporter role to access restricted CI artifact report content they were not authorized to, due to missing authorization checks.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.

GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper authorization, due to insufficient access control checks.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels, due to incorrect authorization logic on label ownership scope validation.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Guest access to read confidential epic content meant to be restricted by external authorization, due to incorrect authorization checks.

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a project-scoped fine-grained Personal Access Token to modify integrations belonging to a group outside the token's scope, due to incorrect authorization checks.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges due to improper cleanup of scheduled pipeline execution policy records.