Shadowserver reported more than 1,000 internet-exposed GitLab servers still unpatched against CVE-2026-97229, which CISA confirms is being actively exploited. GitLab urges self-managed operators to upgrade immediately.
Shadowserver said on 1 November 2026, that more than 1,000 internet-exposed GitLab servers remained unpatched against CVE-2026-97229, a flaw under active attack. The watchdog’s figure counts vulnerable servers, not confirmed compromises, BleepingComputer said.
GitLab released security patches on 12 October 2026, and strongly recommended immediate upgrades for self-managed installations—servers that customers operate themselves. The US Cybersecurity and Infrastructure Security Agency (CISA) has since added the flaw to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation.
The flaw affects GitLab’s CI/CD Regular Expression Compiler, which processes text-matching patterns in configuration files for automated software-building and testing pipelines. It involves an integer overflow, where a calculation exceeds the range a program can represent. GitLab says insufficient validation could, under certain conditions, let a user without authentication run arbitrary code on the server through a specially crafted pattern.
In an analysis first published 13 October 2026, Rapid7 qualified that access description: its test required a way to place a malicious pipeline configuration in a repository. Servers that let new users register themselves and create projects remove that access constraint.
| Affected versions |
|---|
Apple says the error appears only on the resting Always On display after daylight-saving changes. Waking the screen shows the correct hour, and owners can try changing the watch face or restarting.
| 19.2 before 19.2.8 | 19.2.8 |
| 19.3 before 19.3.5 | 19.3.5 |
| 19.4 before 19.4.2 | 19.4.2 |
GitLab says these releases fix the vulnerability. GitLab.com is already patched, and GitLab Dedicated customers do not need to take action.
CISA’s Binding Operational Directive 26-04 applies to Federal Civilian Executive Branch agencies. It prioritizes rapid remediation of known exploited flaws on publicly exposed systems where exploitation grants total control, and sets expectations for checking whether attackers compromised systems before patches were applied. CISA encourages other organizations to prioritize these vulnerabilities too.
For operators unable to upgrade immediately, Rapid7 recommends restricting anonymous access to public projects and preventing untrusted users from creating or writing to them. These controls reduce exposure only to the attack path Rapid7 demonstrated; they do not fix the compiler. Rapid7 recommends upgrading affected self-managed servers without waiting for the normal patch cycle.
1 min
PIF retains 51%. Aramco says the deal commits it to contributing about $2.6 billion in cash to Humain in 2026, alongside technology assets, to support the company’s expansion.
2 min
HayPass opened its first office at Yerevan Mall on 31 October 2026. Armenia’s Interior Ministry said on 2 November that thousands had preregistered online and were arriving for services.
2 min
