https://vanemmerik.ai/supply-chain/ Supply Chain Watch entries: RubyGems. en https://vanemmerik.ai/supply-chain/2026-10-23/#gitlab-onigmo-rce-cve-2026-110264 vea-sc-2026-10-23-gitlab-onigmo-rce-cve-2026-110264 Sat, 24 Oct 2026 02:45:00 +0000 GitLab's Oct 21 critical patch release fixes an unauthenticated remote code execution bug triggered by a crafted Org-mode file, rooted in an integer overflow in Onigmo, the regex engine inside Ruby. Fixed GitLab versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13; GitLab.com is already patched. On Oct 23 the Ruby team released 4.0.9, 3.4.12 and 3.3.13 with fixes for the underlying regex bugs. It is not in CISA KEV yet, but public repositories claiming proofs of concept have appeared. What to do: Upgrade self-managed GitLab now (older than 18.11 means following upgrade stops to 18.11.13 or later). Update Ruby on self-compiled installs and on any service that compiles regexes from untrusted input.