Over 1,000 GitLab servers vulnerable to ongoing RCE attacks
CISA added CVE-2026-97229 to KEV catalog; over 1,000 unpatched GitLab instances exposed to exploitation.
Stories per day · 30 days
5 RSS
Relatedgitlab11rce8supply-chain7cve-2026-972296github4integer-overflow4credential-theft3github-actions3kev3patch3cisa2ghostaction2onigmo2poc2rapid72remote-code-execution2secrets2actions-checkout1
47 stories, newest first · one card per story
Stories tagged #ci-cd
Hackers target 61 GitHub repos with command injection
Coordinated attack on 61 repositories used command injection in GitHub Actions to steal CI/CD secrets; 83 malicious issues and PRs identified.
1
Attackers exploit max-severity GitLab flaw CVE-2026-97229
The integer overflow allows unauthenticated code execution through a crafted CI/CD regular expression; fixes are 19.4.2, 19.3.5, and 19.2.8.
CISA confirms active exploitation of GitLab CVE-2026-97229
Unauthenticated attackers can run code via a crafted CI/CD regex; federal remediation is due November 1.
GitHub issues used in CI attacks on 61 public repositories
Radware counted 83 payloads, mostly within 43 minutes on September 1, aimed at stealing CI secrets; code changes remain unconfirmed.
2
CISA KEV lists GitLab unauthenticated RCE CVE-2026-97229
A crafted regular expression in CI/CD configuration can run arbitrary code; the federal due date is November 1, 2026.
Alpine rebuilds GitLab after CVE-2026-97229 exploit attempts
Alpine found no proof of code execution or package tampering, but reset every password and replaced GitLab secret keys.
3
Jenkins advisory reports multiple vulnerabilities
An October 28 oss-security note links the Jenkins advisory but gives no flaw, version or fix details.
Attackers hit 42 GitHub repos with files too large to search
Oversized wrappers and a native addon hid one CI-publisher payload while an npm worm stole tokens and spread through Actions.
GitHub Actions pwn-request fixes still leave checkout gaps
Old actions/checkout SHA pins and triggers such as issue_comment can still run fork code with secrets.
1
Essay says credential risk spans code, endpoints, vaults and AI
It argues one exposed secret can recur across laptops, pipelines, chat, Git history, and agent context.
1
GhostAction plants malicious workflows in 790 GitHub repositories
October payloads mine full Git history for cloud and AI keys and post them over HTTP to 193.32.204.199.
5
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
Rapid7 shows a reliable RCE proof of concept for GitLab's CVSS 10 regex flaw CVE-2026-97229.
9
PoC Exploit Released for Critical GitLab RCE Vulnerability (CVE-2026-97229)
A public PoC shows critical GitLab CVE-2026-97229 can run commands after a project push.
9
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
GhostAction compromised about 1,900 GitHub accounts and pushed malicious workflows to steal CI secrets from tens of thousands of repositories.
10
CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab
Rapid7 reproduced unauthenticated GitLab RCE CVE-2026-97229 (CVSS 10) and urges immediate patching.
2
CVE-2026-97229: Critical GitLab RCE
GitLab patched CVE-2026-97229, a CVSS 10.0 unauthenticated RCE in self-managed servers.
7
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab patched CVE-2026-97229, a CVSS 10.0 bug letting unauthenticated users run code on CE and EE servers.
2
Critical GitLab Vulnerability Enables Arbitrary Code Execution Attacks on Servers
GitLab patched CVE-2026-97229, an unauthenticated CVSS 10.0 flaw enabling arbitrary code execution on servers.
7
2026-016: Critical Vulnerability in GitLab CE and EE
GitLab patches critical CVE-2026-97229 (CVSS 10.0) allowing unauthenticated RCE via CI/CD regex compiler, plus 23 other security issues in CE/EE versions.
New GhostAction Attack Compromises Hundreds of GitHub Repos to Steal Secrets
GhostAction hit 346 GitHub repositories, including Uber's, with malicious Actions workflows that stole CI secrets.
8
JetBrains security advisory (AV26-1012)
Canada's Cyber Centre urges TeamCity admins to patch JetBrains flaws fixed in 2026.1.3 and 2026.2.1.
Storm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account Takeover
Microsoft attributes an Azure DevOps intrusion to Storm-3068, who abused password resets to hijack accounts and steal Kubernetes kubeconfig files via malicious pipelines.
2
Continuous Assurance of Agentic Security Auditors for Software Delivery Decision Gates
Researchers propose TAIP to continuously recompute assurance for LLM repository auditors used as CI merge gates.