A critical vulnerability in GitLab allows unauthenticated remote code execution across 12 years of releases.

Oh. My. Bob. It is a hella day to be in #infosec, I tell you what. #Gitlab has a CVSS 10! and released critical patch updates on October 21, 2026, addressing multiple severe vulnerabilities including an unauthenticated Remote Code Execution (#RCE) flaw. The patches cover GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. The update fixes CVE-2026-110264, a CVSS 10.0 integer overflow in the regular expression compiler that allows unauthenticated code execution across all self-managed versions dating back to 7.0 (2014). The release also remediated 10 additional security issues, including cache poisoning in OAuth/OIDC endpoints (told you it was problematic). Administrators of self-managed GitLab instances are strongly advised to upgrade immediately, as GitLab.com and GitLab Dedicated tenants already have the fixes applied. https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html GitLab fixes CVE-2026-110264, a critical flaw that could allow unauthenticated code execution on self-managed versions dating back to 7.0. --- 50 uses from 50 accounts #toplink