BreakingCyber Security
GitLab patches maximum-severity remote code execution flaw plus 23 other bugs
On 12 October 2026 GitLab shipped versions 19.4.2, 19.3.4 and 19.2.8, closing 24 security holes in self-managed CE/EE. The headline fix is CVE-2026-97229, a CVSS 10.0 bug in the CI/CD regex compiler where weak expression validation causes an integer overflow, letting an unauthenticated attacker craft a CI/CD configuration that executes code on the server. CERT-EU is pushing organisations to patch immediately, with internet-facing GitLab instances first in line.