ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “gitlab”

12 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 19Vulnerability 11Advisory 5Industry 4Malware 4Threat actor 3Research 3Data breach 2Policy & legal 2Tools 2AI safety & security 1AI tools & infra 1
SeverityAllcritical 14high 20medium 8low 3info 12

Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code

GitLab issues emergency patches for critical path-traversal flaw CVE-2026-85706 (CVSS 10.0), GraphQL credential exposure CVE-2026-87719, and potential RCE flaw CVE-2026-88765.

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing 18 vulnerabilities across Community and Enterprise Editions. CVE-2026-85706 allows unauthenticated arbitrary file reads via the repository commits API; CVE-2026-87719 exposes Advanced Search credentials through GraphQL subscription deserialization; CVE-2026-88765 may enable authenticated RCE via crafted project export imports. No exploitation was reported, but self-managed administrators are urged to upgrade immediately and review logs for suspicious API and GraphQL activity.

GBHackers · 5d agoVulnerabilityCVE-2026-85706CVE-2026-87719CVE-2026-88765+15 CVEs1

GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

GitLab patched CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal enabling arbitrary file reads, already probed in the wild.

GitLab released patches for a maximum-severity path traversal flaw (CVE-2026-85706, CVSS 10.0) in the repository commits API, caused by improper path confinement and missing authentication enforcement, allowing unauthenticated arbitrary file reads. watchTowr observed active in-the-wild probes starting 06:00 UTC on September 11, 2026; exploitation requires at least one public project and enables theft of credentials, secrets, and configuration data. GitLab also patched CVE-2026-87719 (CVSS 9.9), an insecure deserialization bug in Enterprise Edition allowing authenticated Duo Chat users to access Advanced Search configurations and sensitive credentials via crafted GraphQL subscription arguments. Affected versions include 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, and the flaw follows the recently exploited GraphQL code injection bug CVE-2026-19478.

The Hacker Newsupdated · 1d agofirst · 5d agoExploit / PoC in the wild 18 sourcesCVE-2026-85706CVE-2026-87719CVE-2026-194781

GitLab Patches Critical Unauthenticated GraphQL Vulnerability

GitLab issued an emergency patch for a critical unauthenticated GraphQL flaw (CVE-2026-19478, CVSS 9.4) enabling remote modification or deletion of public projects.

GitLab patched CVE-2026-19478 (CVSS 9.4), an unauthenticated GraphQL directive flaw allowing remote modification or deletion of public projects and user data on self-managed servers. The emergency patch released August 17 covers versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11, but no fixes exist for the 18.2-18.10 branches. A second issue, a CSRF weakness in GraphQL multiplex queries (CVE-2026-19650, CVSS 7.1), shipped in the same release. No exploitation or public PoC has been observed; the flaw was reported by hiimguardian through HackerOne.

Security Affairs · 29d agoVulnerabilityCVE-2026-19478CVE-2026-196501

Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)

GitLab patched a critical unauthenticated code injection flaw CVE-2026-19478 (CVSS 9.4) enabling modification or deletion of public projects; upgrades urged.

GitLab released patches for two vulnerabilities affecting Community Edition (CE) and Enterprise Edition (EE) versions 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. CVE-2026-19478 (CVSS 9.4) is an unauthenticated code injection via a GraphQL directive, exploitable remotely without user interaction, allowing attackers to modify or delete public projects and user data. CVE-2026-19650 (CVSS 7.1) is a cross-site request forgery issue in the GraphQL multiplex query handler allowing mutations via GET requests with user interaction. Fixes are available in 18.11.11, 19.0.8, 19.1.6, and 19.2.4; both flaws were reported via GitLab's HackerOne bug bounty program.

Help Net Security · 29d agoVulnerabilityCVE-2026-19478CVE-2026-196501

⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.

The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.

The Hacker News · 19d agoThreat actor in the wildCVE-2026-194781

Coast Guard, FBI board US-bound foreign ships in order to probe for cyberattacks

US Coast Guard and FBI boarded two foreign tankers bound for the US after indications their vessel networks were compromised, investigating possible Iranian involvement.

The Coast Guard and FBI conducted joint offshore security boardings of two commercial ships in the Gulf of Mexico on August 21 and 24 to examine their operational and IT systems following indications both networks were compromised. The vessels reportedly carried oil and natural gas, and one was hacked in the Strait of Gibraltar and lost communications for over 30 hours. No operational disruptions, vessel instability, or environmental impacts have been reported, and authorities are investigating whether Iran or another group exploiting US-Iran tensions was behind the attacks.

CyberScoopupdated · 2h agofirst · 6h agoData breach in the wild 2 sources

Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads

Hijacked verified HBO Max Reddit account ran 108 ClickFix malvertising ads delivering AMOS infostealers, Windows loaders, and crypto clipboard hijackers.

HudsonRock and ADAMnetworks identified a cross-platform ClickFix operation dubbed PasteSwitch that abused the compromised verified Reddit account u/hbomax to publish 108 malicious ads over 48 hours, using domains like hbomaxx[.]us and codex-craft[.]com. macOS victims run curl/zsh commands delivering AMOS-related stealers and fake wallets, while Windows users get an InstallFix route using mshta and PowerShell that loads Amatera in memory and disables AMSI. The operation's AnimateClipper and ZigClipper families hijack clipboards to swap cryptocurrency addresses, with C2 domains rotated via Binance Smart Chain contracts. Reddit paused the ads and is investigating.

Cyber Security Newsupdated · 1d agofirst · 1d agoMalware in the wild 7 sources

Three JFrog Artifactory Flaws Exploited for Backdoor Deployment

Wiz reports multiple actors chaining three JFrog Artifactory auth flaws to gain admin and deploy backdoors; CISA added all three CVEs to KEV.

Wz reports threat actors exploiting CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329 in self-hosted JFrog Artifactory instances to bypass authentication and gain administrative privileges. Between August 15 and September 8, 2026, multiple actors chained CVE-2026-42018 and CVE-2026-42016 to mint anonymous-user tokens, escalate privileges, create persistent admin accounts, install malicious plugins for code execution, and drop second-stage payloads. From early September, CVE-2026-82329 was exploited for configuration exfiltration, cluster key theft, token minting, and SSH key attachment to attacker-created accounts. CISA added all three CVEs to its KEV catalog, giving federal agencies two weeks under BOD 26-04 to patch to versions 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28, or 7.111.21.

SecurityWeek · 2d agoExploit / PoC in the wild 7 sourcesCVE-2026-42016CVE-2026-42018CVE-2026-82329

August 2026 CVE Landscape

Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.

Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.

Recorded Future · 8d agoVulnerability in the wildCVE-2025-62593CVE-2026-72898CVE-2026-9198+4 CVEs1

Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks

Australian Federal Police charges two men with 14 offences over TeamPCP supply chain backdoors in Trivy, Checkmarx KICS, and LiteLLM affecting 1,000+ organizations.

The Australian Federal Police charged two Western Australian men, aged 21 and 23, with 14 offences for their alleged principal roles in TeamPCP's March 2026 supply chain attacks; they appeared in Perth Magistrates Court on August 27, 2026. The group stole publishing credentials from trusted open-source projects and pushed poisoned releases across five ecosystems - GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX - with LiteLLM's unpinned Trivy install enabling token theft and backdoored LiteLLM releases. The FBI said the malicious code potentially compromised more than 1,000 organizations, enabled theft of over 500,000 credentials, and exfiltrated at least 300 GB of data. Oligo Security linked the group's infrastructure to activity back to 2020, previously tracked as TA-NATALSTATUS and IronErn.

The Hacker News · 20d agoPolicy & legal in the wild1

U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog

CISA added the actively exploited Gitea RCE flaw CVE-2026-60004 (CVSS 9.8) to its KEV catalog, with federal patching due by August 28, 2026.

CISA added CVE-2026-60004, a critical remote code execution flaw in Gitea (CVSS 9.8), to its Known Exploited Vulnerabilities catalog. The flaw affects Gitea versions since 1.17, fixed in 1.27.1, and lets attackers with repository write access execute shell commands via the diffpatch API and Git hooks. Open registration allows unauthenticated attackers to create accounts and exploit exposed instances, with a reported attack deploying a cryptocurrency-miner-like payload.

Security Affairs · 21d agoExploit / PoC in the wildCVE-2026-60004

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business News · 28d agoThreat actor in the wild1