Shadowserver reports more than 1,000 internet-facing GitLab servers remain vulnerable to CVE-2026-97229, a critical integer overflow bug in GitLab's CI/CD Regular Expression Compiler that lets unauthenticated attackers run arbitrary code via crafted regex in pipeline configs. GitLab shipped fixes on October 12 in versions 19.4.2, 19.3.5 and 19.2.8, but CISA has now confirmed active exploitation and added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until Sunday to patch.
bleepingcomputer.com
· 2026-11-02
Attackers tried to exploit CVE-2026-97229, a maximum-severity remote code execution flaw in GitLab's CI/CD regex compiler, against Alpine Linux's development infrastructure on October 20-21, repeatedly crashing GitLab processes. Alpine found no direct evidence code was executed or packages tampered with, but due to missing logs it could not rule out compromise, so it rebuilt its GitLab instance and reset all passwords.
bleepingcomputer.com
· 2026-11-01
CISA added CVE-2026-97229, a maximum-severity GitLab vulnerability, to its Known Exploited Vulnerabilities catalog after confirming attackers are exploiting it in the wild. The flaw, an integer overflow in GitLab's regular expression compiler, lets unauthenticated attackers run arbitrary code via crafted CI/CD configurations; GitLab patched it in versions 19.4.2, 19.3.5 and 19.2.8 earlier this month.
bleepingcomputer.com
· 2026-10-30
Alpine Linux said an attacker tried to exploit a critical GitLab vulnerability (CVE-2026-97229, CVSS 10.0) against its gitlab.alpinelinux.org instance on October 20-21, a week after a fix was released but before the instance was patched. The attempts crashed worker processes eight times and came close to succeeding, though the team found no confirmed evidence of a successful breach. As a precaution, the instance was rebuilt from scratch, all user passwords were reset, and the service is being tested before reopening to the public.
alpinelinux.org
· 2026-10-28
Between October 16 and 23, 2026, PHP, Node.js, GitLab, LiteLLM, OpenCode and the eMudhra certificate authority each disclosed serious security incidents. PHP, Node.js and GitLab all shipped fixes on October 21, the same day a bad LiteLLM release was pushed out. Amazon's MadPot honeypots recorded attempts to exploit the PHP flaws four days before they were publicly disclosed.
cloudsleuth.io
· 2026-10-27
GitLab has released patches for CVE-2026-110264, a critical integer overflow vulnerability in its Regular Expression Compiler that could allow unauthenticated attackers to execute arbitrary code on vulnerable servers. The flaw, reported by researcher 'joaxcar' via HackerOne, has been fixed in CE and EE versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com and GitLab Dedicated tenants on patched internal builds are already protected, but self-managed installations must upgrade immediately.
bleepingcomputer.com
· 2026-10-22
GitLab released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for its Community and Enterprise Editions on October 21, 2026, fixing an integer overflow vulnerability in its regular expression compiler tracked as CVE-2026-110264. GitLab.com is already running the fix, and GitLab Dedicated tenants on certain internal builds already include it, but self-managed installations must upgrade manually.
docs.gitlab.com
· 2026-10-21
GitLab issued an advisory urging immediate patching of a maximum-severity vulnerability in its CI/CD Regular Expression Compiler, tracked as CVE-2026-97229. The flaw, an integer overflow found by researcher 'joaxcar' through HackerOne, could let an unauthenticated attacker execute arbitrary code via a crafted regular expression in a CI/CD configuration file. GitLab fixed the issue in versions 19.2.8, 19.3.4, and 19.4.2, noting GitLab.com and Dedicated customers are already protected.
bleepingcomputer.com
· 2026-10-12
Agent.reviews introduces an AI-powered platform that reads and writes reviews on various software tools, including source control and code review repositories. The platform aims to streamline the review process by automating assessments of code and repository configurations.
agent.reviews
· 2026-10-07
GitLab issued an advisory urging immediate patching of CVE-2026-90970, a critical vulnerability in its AI Gateway service that powers GitLab Duo. The flaw lets an authenticated user with Duo Agent Platform access escape a prompt template sandbox via a crafted flow configuration and run arbitrary commands on self-hosted AI Gateway instances. GitLab released versions 19.2.4, 19.3.2, and 19.4.1 to fix the issue, noting GitLab-hosted AI Gateway customers are already protected.
bleepingcomputer.com
· 2026-10-02
Developer Iain Cambridge argues that Go's practice of importing packages by their git-hosting URL (e.g. github.com/user/repo) ties codebases to a specific provider like GitHub. He describes a company that ended up paying for GitLab, GitHub, and Azure DevOps simultaneously because switching import paths was too costly, and says he built a tool called Boneclone to replicate code across multiple git hosts. His proposed fix is to use a custom domain (e.g. go.iain.rocks/boneclone) that redirects to the actual host, so the underlying provider can be changed without altering import paths.
iain.rocks
· 2026-09-27
GitLab reported widespread 503 errors on GitLab.com beginning around 23:04 UTC on September 24, 2026, impacting the website and API among other components. The company said it identified the cause and was working on mitigation, later reporting signs of recovery by 23:44 UTC while the fix remained ongoing.
status.gitlab.com
· 2026-09-24
GoKawiil