Anyone who patched a self-managed GitLab server last week has to do it again. GitLab put out another critical release on Wednesday for CVE-2026-110264, a remote code execution flaw rated 10.0 on the CVSS scale that an attacker can reach without logging in.

The fixed builds are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, listed in the company’s patch release notes . On the 19.2, 19.3 and 19.4 branches, they sit one step past the builds GitLab shipped on Oct. 12 to close CVE-2026-97229, an earlier 10.0-rated integer overflow in its CI/CD regex compiler that Rapid7 published a proof-of-concept for the next day. This one reaches much further back. Every Community and Enterprise Edition release since 7.0, which came out in June 2014, is affected, and GitLab credited joaxcar, the same HackerOne researcher behind the Oct. 12 bug.…