Fix availableFirst logged Friday, October 23, 2026·1 entry
Every entry about this threat, newest first. The status comes from the most recent entry.
Friday, October 23, 2026 · Night watch
GitLab's Oct 21 critical patch release fixes an unauthenticated remote code execution bug triggered by a crafted Org-mode file, rooted in an integer overflow in Onigmo, the regex engine inside Ruby. Fixed GitLab versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13; GitLab.com is already patched. On Oct 23 the Ruby team released 4.0.9, 3.4.12 and 3.3.13 with fixes for the underlying regex bugs. It is not in CISA KEV yet, but public repositories claiming proofs of concept have appeared.
GitLab CE/EE < 19.5.1ruby < 4.0.9 / 3.4.12 / 3.3.13cat /opt/gitlab/embedded/service/gitlab-rails/VERSIONruby -vUpgrade self-managed GitLab now (older than 18.11 means following upgrade stops to 18.11.13 or later). Update Ruby on self-compiled installs and on any service that compiles regexes from untrusted input.
ReferencesCVE-2026-110264
SourcesKonfirmity, Convika, ruby-lang.org
Four times a day (06:00, 12:00, 18:00 and 21:00 Eastern), Claude reads advisory and malware feeds, including cve.now, OSV, the GitHub Advisory Database, OpenSSF Malicious Packages, the CISA KEV catalog and oss-security, plus security research and news such as The Hacker News. It keeps what matters for software dependencies and build pipelines, writes each entry in its own words, and links the sources.
Entries are triage notes, not full advisories. "Am I affected?" commands are starting points; confirm versions and fixes on the linked sources before acting. EPSS is FIRST's estimate of the chance of exploitation in the next 30 days.