GitLab fixes a CVSS 10.0 code execution flaw in its CI/CD regex compiler

GitLab released fixes for CVE-2026-97229, rated CVSS 10.0, which under certain conditions lets an unauthenticated user run code on a self-managed server. HAProxy Data Plane API and OTRS Community Edition have authentication bypasses, and Ahold Delhaize, Albert's parent, took systems offline after a security incident.

Vulnerabilities

CVE-2026-97229 - GitLab CE/EE, CVSS 3.1 10.0

What it allows. An integer overflow in GitLab’s CI/CD regular expression compiler could, “under certain conditions”, let an unauthenticated user execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, according to the critical patch release GitLab published on 12 October. GitLab does not say what those conditions are, and does not report exploitation.

Affected. GitLab Community and Enterprise Edition 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. GitLab.com already runs the fix and GitLab Dedicated customers need not act, so it is self-managed instances that need patching.

Fix. Upgrade to 19.4.2, 19.3.5 or 19.2.8, as the release post lists. GitLab gives no workaround. The patch carries database migrations, so a single-node instance is down during the upgrade until they finish. The same release fixes five more flaws that GitLab rates high.

Exposure. product:"GitLab Self-Managed" matches 44,640 results worldwide.

No banner carries a GitLab version, so these are exposed instances, not confirmed vulnerable ones. 29,462 of the results answer on port 443 and 13,198 run at a cloud provider.

CVE-2026-109575 - HAProxy Data Plane API, CVSS 3.1 9.8

What it allows. When the HAProxy Data Plane API is set up for mutual TLS, it switches off Basic authentication on a request handler that its HTTP, HTTPS and UNIX socket listeners share, while only the HTTPS listener checks client certificates. An unauthenticated attacker who can reach the HTTP listener or the UNIX socket gets full administrative access to the API, and can read the HAProxy configuration in cleartext or replace it, according to the CVE record published on 12 October. No source reports exploitation.

Affected. Data Plane API 2.2.0 through 3.4.3 and the matching Enterprise releases, when tls_ca and a numeric tls_port are configured and an HTTP or UNIX socket listener runs alongside the HTTPS one.

Fix. Versions 3.4.4, 3.3.9, 3.2.17, 3.0.25 and 2.9.29, and their Enterprise backports, fix it, per the CVE record. The 3.4.4 release of 9 October lists the change only as “enforce basic auth on non-mTLS listeners”, with no CVE or advisory. No source gives a workaround.

CVE-2026-93582 - ((OTRS)) Community Edition, CVSS 3.1 9.4

What it allows. The HTTP Basic Authentication modules take the username from either REMOTE_USER or HTTP_REMOTE_USER. In CGI and mod_perl deployments a Remote-User request header reaches the application as HTTP_REMOTE_USER, so an unauthenticated attacker can log in through the Generic Interface as any existing agent or customer user without their password, and act with that user’s permissions. OTRS advisory OSA-2026-18 of 12 October rates it critical and does not say it is exploited.

Affected. ((OTRS)) Community Edition 6.x and earlier, where HTTP Basic Authentication is the configured authentication backend and the web server passes request headers to the application as HTTP_* variables. OTRS 7 and later are not affected. OTRS says products based on Community Edition are “very likely” affected as well: Znuny’s ZSA-2026-14 of 16 September describes the same fallback in Znuny LTS 6.5.1 to 6.5.24, Znuny 7.3.1 to 7.3.6, and every release of 6.0 to 6.4 and 7.0 to 7.2.

Fix. OTRS lists no fixed Community Edition release and no workaround; its advice is to update to OTRS 2026.7.1 or later. Znuny fixed the flaw in Znuny LTS 6.5.25 and Znuny 7.3.7.

Regional

• Ahold Delhaize, the retail group that owns Albert in Czechia, said on 12 October that it is “experiencing a security issue within its network” and has taken some systems offline while its stores stay open, and BleepingComputer reports websites, apps and customer service down at Albert Heijn, Etos and Gall & Gall in the Netherlands and Delhaize in Belgium. The same day Albert said customers may find the Můj Albert app limited, after Kupi.cz found leaflets and coupons not loading and the loyalty card failing to scan, and that discounts are applied at the till without the app and no points are lost. Neither company has said whether the app outage comes from the incident, or whether any data was taken.
• SK-CERT warned on 12 October, rating it critical with a CVSS score of 10.0, that attackers are exploiting CVE-2026-105134, unauthenticated remote code execution in the Replication Receiver of AhsayCBS, the management server for Ahsay’s backup software, together with the authentication bypass CVE-2026-105133. Huntress has seen the two chained since 7 October to drop webshells and an XMRig cryptominer, and lists hotfix 10.3.4.45 for version 10, which 10.3.4 itself still needs, and 9.15.2.70 for versions 7 to 9. Apply the hotfix, restrict the management interface to trusted addresses, change passwords and keys on the server and anything that shares them, and check logs for the indicators SK-CERT lists.
• The Bavarian town of Eichstätt said on 12 October that its administration was hit by a criminal cyberattack, discovered that morning: most of its IT is offline, the town hall and its branch offices are closed, and email is down. Police and the state criminal police office are investigating, including whether data was taken, and the town’s utility company is not affected. The town asks residents to be wary of messages that appear to come from it, and to check invoices from the town hall carefully before paying them.
• Poland’s National Prosecutor’s Office published on 12 October partly declassified findings by ABW forensic experts on the Pegasus spyware the CBA anti-corruption bureau used: the CBA lacked full control of the system, the server module that infects devices stayed under the producer’s control, and data the system transmitted left Poland through an anonymising network the producer ran. The experts do not determine whether the producer actually accessed surveillance material. Seven people, among them former heads of the CBA, ABW and SKW, have been charged in the investigation, which began in March 2024.
• Germany’s BSI, with the interior and digital ministries, published a guideline on 12 October for moving to post-quantum cryptography, aimed at federal, state and local administrations, companies and critical infrastructure operators. It confirms the EU roadmap: high-risk use cases should finish migrating by the end of 2030 at the latest, and the whole transition should be largely complete by 2035. It advises naming owners and binding deadlines, assessing quantum risk within risk management, involving vendors and supply chains early, and building crypto-agility, so algorithms and key lengths can be swapped quickly.

This digest is created with the help of AI-enabled tools and may contain inaccuracies. If you find one, let me know.