Originally published on The Homelab Fixer .

On October 21, 2026 , GitLab shipped a critical patch release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 for Community and Enterprise Edition. The headline fix is CVE-2026-110264 — an integer overflow in the regex compiler that, in GitLab's own words, "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server ." Severity: Critical, CVSS 10.0 . Every self-hosted GitLab from version 7.0 onward is exposed unless it's on a fixed build.

This is the operator's version of the story: which build your line needs, how to back up first, the Docker and Omnibus upgrade path, the migration-downtime trap on 19.4.x, and what to do if you can't patch tonight. Same patch-tonight discipline as our php2shell emergency RCE playbook — different stack, same urgency.

⚠️ Honest testing note. We did not reproduce an exploit in a lab — deliberately.…