GitLab’s 12-Year-Old Flaw Demands Another Patch
In a stunning display of digital archaeology, GitLab patched a CVSS 10.0 flaw that could let unauthenticated attackers run server code through a crafted regular expression, under certain conditions. The kicker? CVE-2026-110264 affects unpatched Community and Enterprise releases dating all the way back to 7.0 in 2014.
Self-managed admins need to drop everything and upgrade immediately to the appropriate fixed release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13. (Don’t panic, GitLab.com is already patched.) While you’re at it, check your application logs for exploitation attempts using GitLab’s two new detection rules (which hunt for specific worker crashes and render errors).
And yes, you still have to update even if you applied last week’s fixes—the Oct. 12 patches don’t fix this separate vulnerability. Fortunately, no exploitation was reported as of Thursday.
Apparently, your patch needs a patch.
SafePay Hits 600 Victims and Their Backups
In today’s episode of “Why We Can’t Have Nice Things,” the FBI and CISA are warning that the SafePay ransomware gang has breached more than 600 critical infrastructure providers globally since August 2024, according to a joint Oct. 20 advisory. Entry points include stolen credentials, phishing, and the classic unpatched flaws in internet-facing systems.
Because merely locking you out of your network wasn’t obnoxious enough, the group actively hunts backups, often factory-resetting network storage devices to nuke your recovery data. And don’t think restoring your systems gets you off the hook—it won’t erase their threat to leak your stolen files online.
Defenders should patch exposed VPNs and firewalls, require MFA, aggressively restrict admin access, and maintain offline, immutable backups with actually tested restoration procedures.
SafePay—an impressively dishonest name, even by ransomware standards.
PHP Vulnerabilities Trigger Emergency Fixes
Two critical PHP vulnerabilities could allow remote code execution.
PHP-powered websites and business applications may be at risk, especially those running older or unsupported versions.
With exploitation attempts already reported, I’m concerned these flaws could have widespread impact similar to Heartbleed or Log4Shell.
Patch affected PHP installations immediately and audit server logs for signs of exploitation.
Splunk Patches RCEs and Other Flaws
Splunk patched three critical vulnerabilities rated CVSS 9.9 and two RCE flaws affecting Splunk Enterprise and SOAR.
One RCE vulnerability could allow lower-privileged users to execute operating-system commands on Splunk search head cluster members.
My concern is that exploitation could expose logs and undermine the integrity of incident investigations.
Apply the latest patches, audit user privileges, and review logs for suspicious activity.
Oracle Patches 1,209 Vulnerabilities, Including Six Critical Bugs
Oracle’s latest update patches 1,209 vulnerabilities, including six flaws rated CVSS 10.0.
The flaws affect enterprise applications such as Oracle Access Manager and E-Business Suite and could be exploited remotely without authentication.
With over 1,200 vulnerabilities to assess, I’m concerned that relying on CVSS scores alone could cause teams to overlook actual exposure.
Prioritize internet-facing Oracle systems, assess business-critical dependencies, and verify successful patch deployment.
ARTEX AI Tool Linked to Japan Cyberattacks
Japanese researchers found the Chinese-developed ARTEX AI tool on infrastructure targeting approximately 20 Japanese companies.
They also identified six additional AI-enabled attack servers, while separate research uncovered AI-assisted vulnerability scanning of mobile applications and APIs.
What concerns me is attackers reverse-engineering mobile apps to uncover backend API weaknesses that organizations may not be adequately testing.
Audit exposed APIs, enforce server-side authorization, and monitor for unusual request patterns that could indicate automated attacks.
Can Your Patching Keep Up?
Recent PHP vulnerabilities prompted European government websites to go offline, showing why organizations need a strong patch management program.
How to strengthen patch management:
- Maintain an accurate software inventory using SBOMs to identify vulnerable components and prioritize patches for actively exploited flaws.
- Use patch management tools to automate security updates and reduce deployment delays.
- Test patches for compatibility before deployment and verify successful installation through vulnerability scans.
Effective patch management helps reduce the attack surface and minimize operational disruptions.