Over 1,000 GitLab servers vulnerable to ongoing remote code execution attacks

According to recent reporting, over 1,000 Internet-exposed GitLab servers are still running unpatched software and are being actively targeted in remote code execution attacks. The vulnerability is classified as maximum severity, meaning it can be exploited without authentication to execute arbitrary code on the affected instance. Shodan scanning data has been used to identify the scope of exposed and unpatched systems, revealing a significant number of potential targets still at risk. Exploitation of the flaw allows threat actors to gain unauthorized access to GitLab instances, potentially leading to data exfiltration, lateral movement into connected environments, and service disruption. The exact CVE identifier associated with the active exploitation was not disclosed in the initial report, but the severity classification underscores the urgency of remediation. GitLab administrators are advised to verify their instance version against the latest security update and apply patches without delay. Restricting network exposure and monitoring for suspicious activity are also recommended as defensive measures.