Emergency Patch for Unauthenticated RCE in GitLab: How to Upgrade from 17.11 to 19.5.1

On October 21, GitLab released an emergency patch. There are seven versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, ...
The Hacker News

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

GitLab fixes CVE-2026-110264, a critical flaw that could allow unauthenticated code execution on self-managed versions dating back to 7.0.
The Eastern Herald

GitLab Patches Critical No-Login Code Execution Flaw

GitLab's October 21 release fixes CVE-2026-110264 across seven version lines. Self-managed installations need attention; ...
Help Net Security

Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)

GitLab has released patches for two vulnerabilities, including a critical-severity code injection flaw that can be exploited without authentication. The vulnerabilities affect GitLab Community Edition ...
The Hacker News

Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open

Alpine Linux rebuilt its GitLab server after an RCE exploit attempt and found that upgrading GitLab alone had left the Ruby flaw unpatched.