Critical GitLab Vulnerability (CVSS 10.0) Enables Unauthenticated Remote Code Execution Across 12 Years of Releases
Flaw affects self-managed GitLab instances from version 7.0 (2014) to present; patches released October 21, 2026
Key Takeaways
- Critical vulnerability (CVSS 10.0) allows unauthenticated remote code execution on GitLab self-managed instances
- Affects every version from 7.0 (2014) to present, spanning approximately 12 years of releases
- October 12 patch only covered versions 19.2 and later, creating a gap for older installations
Related Security News
Critical PHP Vulnerabilities Exploited in the Wild, Widespread Patching Required
Security researchers have identified two critical vulnerabilities in the PHP core software that are being actively exploited in the wild. The flaws allow remote attackers to seize full control over affected servers. Approximately 70 percent of websites running unpatched PHP core software are expected to experience outages, including 404 or 'Page Not Found' errors, as administrators apply emergency patches. Working exploits are available, and the vulnerabilities have been reported as already being used by attackers.
OVHcloud GitHub Compromise Attributed to GlassWorm Threat Actors
A developer's GitHub account, compromised several months prior to discovery, was leveraged by GlassWorm threat actors to push malicious code to unsuspecting users. The incident ties back to OVHcloud infrastructure and highlights ongoing supply chain risks within the developer ecosystem.
