🧰 GitLab

The items that name it 47

• Alpine Linux rebuilds GitLab after attempted RCE attack
  articleas affected products2026-11-01

  patched version 19.3.5, fixes released October 12

• Was I wrong about open models & cyber risks?
  articleas affected products2026-10-30

  named among the October critical vulnerability disclosures

• CISA says max severity GitLab flaw now exploited in the wild
  articleas classification.technologies2026-10-30
• Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
  articleas affected products2026-10-30It is written here as GitLab (fixed in 19.3.6 packages; not sufficient for self-managed Ruby setups).

  fixed in 19.3.6 packages; not sufficient for self-managed Ruby setups

• CISA Adds Two Known Exploited Vulnerabilities to Catalog
  advisoryas classification.technologies2026-10-29
• GitLab Security Incident: Attempted Exploitation of CVE-2026-97229
  writeupas classification.technologies2026-10-28
• Preliminary Report Oct 21st Security Incident
  advisoryas classification.technologies2026-10-23
• Daily Vibe Casting (@vibecastingapp) on X
  threadas classification.technologies2026-10-22
• Nagli (@galnagli) on X
  threadas classification.technologies2026-10-22
• Software supply chain security best practices for 2026
  articleas affected products2026-10-21
• lee1981 (@lee1981b) on X
  articleas classification.technologies2026-10-18
• !Manan (@0xManan) on X
  threadas classification.technologies2026-10-16
• S2W_DailyThreat (@S2W_DailyThreat) on X
  advisoryas classification.technologies2026-10-16
• Critical GitLab RCE Lets Unauthenticated Attackers Execute Code on Servers (CVE-2026-97229)
  advisoryas classification.technologies2026-10-14
• Penetration testing every deployment with AWS Continuum
  articleas classification.technologies2026-10-14
• ThreatWire (@ThreatWire_) on X
  threadas classification.technologies2026-10-14
• CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab
  advisoryas classification.technologies2026-10-13
• lee1981 (@lee1981b) on X
  advisoryas classification.technologies2026-10-13
• GhostAction Attack Escalates By Targeting GitHub Users
  writeupas affected products2026-10-09It is written here as GitLab (my-gitlab.com watchlist domain; apparent self-hosted GitLab with nginx at gitlab.my-gitlab.com, 18.167.164.26, AWS EC2 Hong Kong).

  my-gitlab.com watchlist domain; apparent self-hosted GitLab with nginx at gitlab.my-gitlab.com, 18.167.164.26, AWS EC2 Hong Kong

• New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials
  writeupas affected products2026-10-09

  glpat- prefixed personal access tokens harvested by the payload.

• Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules
  writeupas affected products2026-10-09

  versions 19.0.0-19.4.0; additional fingerprint support added

• Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?
  articleas affected products2026-09-25
• The OpenSourceMalware Show #22
  talkas tools2026-09-25

  SCM platform also examined in Atlassian's Contagious Interview research, alongside GitHub and Bitbucket.

• AI Agent Hacking Writeups
  repoas affected products2026-09-17
• Dependabot vs Renovate
  articleas classification.technologies2026-09-14
• Breaking: GitLab Critical Path Traversal Flaw Exploited in the Wild — Patch Immediately
  advisoryas classification.technologies2026-09-14
• CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild
  advisoryas classification.technologies2026-09-14
• CVE-2026-85706: GitLab CE/EE Repository Commits API Path Traversal
  advisoryas classification.technologies2026-09-11
• Rapid Reaction: GitLab Critical Path Traversal Vulnerability (CVE-2026-85706)
  advisoryas classification.technologies2026-09-11
• Rapid Reaction: GitLab Path Traversal Vulnerability (CVE-2026-85706)
  advisoryas classification.technologies2026-09-11
• [tl;dr sec] #345 - Bug Rumors → Exploits, Version Control DFIR, Agentic Worms
  articleas affected products2026-09-10
• The OpenSourceMalware Show #20
  talkas classification.technologies2026-09-09
• vet (SafeDep)
  repoas affected products2026-09-07

  Source repository platform integrated with vet

• The Secure Agentic Development Lifecycle (ADLC), Explained | Blog | Endor Labs
  articleas tools2026-09-02

  Development platform cited as a tool where agent activity should be inventoried and governed

• AI Code Review: How to Actually Review Code an Agent Wrote | Blog | Endor Labs
  articleas affected products2026-09-02

  Platform Endor Labs' AI Code Review integrates with

• Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps
  articleas affected products2026-08-27It is written here as GitLab (cloud and self-hosted).

  cloud and self-hosted

• Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List.
  articleas classification.technologies2026-08-15
• Behind the GitLab RCE: A depthfirst Journey into the Ruby Ecosystem | depthfirst
  writeupas affected products2026-07-27It is written here as GitLab (RCE in previous depthfirst post).

  RCE in previous depthfirst post

• Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities | depthfirst
  writeupas classification.technologies2026-07-24
• One Request to Own Every Repo: How We Hijacked GitLab Through Its MCP Server - Pluto Security
  writeupas classification.technologies2026-07-06
• Socket: Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages
  writeupas classification.technologies2026-06-27
• Betterleaks
  repoas classification.technologies2026-05-10
• OWASP Free AppSec Tools
  articleas tools2026-05-06It is written here as GitLab (built-in security).

  Integrates SAST, DAST, Code Quality, Dependency Analysis, Container Scanning into GitLab CI pipeline; free for public open source projects on GitLab.com

• Weekly Research Brief: PHP Vulnerability; Objections to OKX-ICE’s Stock Tokenization; Solana Alpenglow Ships
  articleas classification.technologies
• GitLab patches critical 9.9 AI Gateway template-sandbox-escape RCE (CVE-2026-90970)
  advisoryas affected products

  As of October 2, these are the GitLab releases GitLab's maintenance policy lists as getting security fixes.

• CVE-2026-44895 - GitHub Advisory Database
  advisoryas classification.technologies
• Betterleaks — secrets scanner from the Gitleaks creator
  repoas classification.technologies