If you run self-managed GitLab, you are on a vulnerable version right now unless you upgraded in the last day. GitLab's October 21, 2026 critical patch release fixes CVE-2026-110264, an integer overflow in regex compilation that the advisory says lets an unauthenticated user run arbitrary code on the server "under certain conditions". CVSS 10.0 ( AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H ). The affected range starts at GitLab 7.0, CE and EE alike, and there is no workaround.

What follows is the release to install for your line, whether it runs migrations, the commands, and what to lock down if the upgrade has to wait until morning.

This is also the second CVSS 10 regex bug in GitLab in nine days. On October 12, GitLab fixed CVE-2026-97229 , another integer overflow in the same regex engine, reported by the same HackerOne researcher (joaxcar). If you skipped that one because "we'll catch the next patch", this is the next patch.

GitLab.com is already patched.…