Max-severity GitLab bug allows remote code execution over 12 years of releases

The Register SecurityOctober 22, 2026AppSec Vulnerabilities

MentionsGitLab

GitLab on Wednesday patched a maximum-severity flaw that could allow unauthenticated attackers to execute arbitrary code on self-managed servers under certain conditions. Affected software releases date back a full 12 years - so upgrade to a fixed version now.

Summary from The Register Security.

Read the full article at The Register Security

Explained

The technology and terms in this story. Learn more

AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.

Other sources covering the same vulnerabilities or event.

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

The Hacker News4d agoAppSecVulnerabilities

More in AppSec

SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.js Brotli Decoder RCE (CVE-2026-111497); Tailscale "Tailworm" Vulnerabilities; HPE ArubaOS 8/10 Patches 72 Flaws

Podcast8 minSANS Internet Storm Center StormCast3h agoAppSecVulnerabilitiesCVE-2026-111497

Risky Bulletin: Brotli RCE is wrecking what's left of the internet

Podcast8 minRisky Business News5h agoAppSec

OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken

Help Net Security7h agoAppSecNetwork

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

The Hacker NewsyesterdayAppSecVulnerabilitiesCVE-2026-111497

New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack

Socket Blog2d agoAppSec