GoKawiil
Tech News
A project called Loopt, posted on Show HN, converts source code written in TypeScript, Python, Go, Rust, or custom plugin languages into standard GitHub Actions YAML files. It includes an init command that scaffolds a starter workflow based on detected project files (like package.json or Cargo.toml) and an import command to convert existing YAML workflows back into editable source code.
CISA added CVE-2026-97229, a maximum-severity GitLab vulnerability, to its Known Exploited Vulnerabilities catalog after confirming attackers are exploiting it in the wild. The flaw, an integer overflow in GitLab's regular expression compiler, lets unauthenticated attackers run arbitrary code via crafted CI/CD configurations; GitLab patched it in versions 19.4.2, 19.3.5 and 19.2.8 earlier this month.
GitLab issued an advisory urging immediate patching of a maximum-severity vulnerability in its CI/CD Regular Expression Compiler, tracked as CVE-2026-97229. The flaw, an integer overflow found by researcher 'joaxcar' through HackerOne, could let an unauthenticated attacker execute arbitrary code via a crafted regular expression in a CI/CD configuration file. GitLab fixed the issue in versions 19.2.8, 19.3.4, and 19.4.2, noting GitLab.com and Dedicated customers are already protected.
GitLab reported widespread 503 errors on GitLab.com beginning around 23:04 UTC on September 24, 2026, impacting the website and API among other components. The company said it identified the cause and was working on mitigation, later reporting signs of recovery by 23:44 UTC while the fix remained ongoing.
Aikido Security found that GitLab's built-in 'Email work item to this project' addresses, which embed a long-lived credential token, are being publicly exposed in READMEs, contributing guides, and support pages. Anyone who obtains one of these addresses can email GitLab to create issues, and by swapping the '-issue' suffix for '-merge-request,' can open merge requests as if they were the token owner, since GitLab does not verify the sender's email matches the token owner and the technique also bypasses IP restrictions.
ImpactGate is a new open-source tool that scores code changes for structural decay before they merge, running as a CLI, git pre-commit hook, or CI plugin for GitHub, GitLab, and Jenkins. It calculates an impact score based on files changed, existing complexity in the code being touched, cyclomatic complexity, and lines changed, making edits to already-bloated classes costlier than new additions.
A software engineering essay, part of a series called 'Conquering Entropy,' examines how AI-generated code changes the trust relationships within engineering organizations—from trusting the ticket author and reviewing engineer to trusting test suites, CI/CD pipelines, and even AI-driven site reliability tools. The author argues that as AI agents make code generation faster and cheaper, teams need explicit accountability: whoever ships a PR should be responsible for fixing it if it breaks in production.