Security

On 21 October 2026 GitLab released a critical patch release that includes CVE-2026-110264, scored CVSS 10.0, the maximum. The flaw is in GitLab CE and EE and, under certain conditions, lets an unauthenticated user run arbitrary code on the GitLab server. The Hacker News has covered it too. If you run a self-managed GitLab, update first and read the rest later. Summary ID CVE-2026-110264 Score 10.0 (Critical) Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Weakness Integer overflow in the regular expression compiler Reporter joaxcar, via GitLab’s HackerOne bug bounty The vector means: reachable over the network, low complexity, no login, no user interaction, with full impact on confidentiality, integrity and availability. ...

On 21 October 2026 the UK National Cyber Security Centre (NCSC) published an alert titled “Critical security issue affecting PHP”. Two vulnerabilities in PHP itself may let an unauthenticated attacker achieve remote code execution (RCE) on a web server running PHP. Both are fixed in new releases. If you run PHP, update first and read the rest later. Summary CVE-2026-109618 CVE-2026-109619 Title RCE via OOM corruption RCE via stale global state CVSS v4.0 9.2 (Critical) 9.2 (Critical) Vector AV:N/AC:H/AT:P/PR:N/UI:N AV:N/AC:H/AT:P/PR:N/UI:N Weakness use-after-free, improper error handling use-after-free, stale global state Both are reachable over the network with no login and no user interaction. ...