If you run self-managed GitLab, October gave you two emergency upgrades in nine days. If you only did the first one, you're still exposed.

Both fixes address maximum-severity, unauthenticated remote code execution . Both trace back to the same weak spot: how GitLab, and the Ruby regex engine underneath it, handle attacker-controlled regular expressions.

The three bugs

CVE Severity Entry point Fixed Status

CVE-2026-93577 9.9 CI/CD regex handling 23 Sep 2026 patched (bypassed by the next one)

CVE-2026-97229 10.0 CI/CD regular-expression compiler 12 Oct 2026 (19.4.2, 19.3.5, 19.2.8) exploited, in CISA KEV since 29 Oct

CVE-2026-110264 10.0 Rendering a crafted .org file 21 Oct 2026 (19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13) no confirmed exploitation as of late Oct

All three were reported by the same researcher, joaxcar , through HackerOne. GitLab.com and GitLab Dedicated weren't affected by CVE-2026-110264.…