GitLab Releases Security Updates Fixing 11 Vulnerabilities Including Two Critical Flaws
GitLab has released security updates addressing 11 vulnerabilities in its development platform, including two Critical flaws that could allow authenticated users to execute arbitrary code on affected servers.
The company published the updates on September 23, 2026, for versions 19.4.1, 19.3.3, and 19.2.7. Both Community Edition (CE) and Enterprise Edition (EE) are affected and have received the fixes.
Critical Vulnerabilities
The two Critical issues carry CVSSv3.1 base scores of 9.9. CVE-2026-89078 is a double-free vulnerability in CI/CD configuration parsing that can be triggered when an authenticated user supplies a specially crafted regular expression, enabling arbitrary code execution on the GitLab server.
CVE-2026-93577 is an integer overflow in the regular expression compiler that similarly permits authenticated attackers to run arbitrary code on the server.
High-Severity Issues
Two High-severity vulnerabilities were also fixed: CVE-2026-84739, a cross-site scripting flaw in the merge request diff display, and CVE-2026-92470, which allows access to sensitive CI/CD variables through the Duo AI job troubleshooting feature.
Additional Fixes
The release further resolves five Medium-severity and two Low-severity vulnerabilities. The complete list of addressed CVEs is:
- CVE-2026-89078 (Critical)
- CVE-2026-93577 (Critical)
- CVE-2026-84739 (High)
- CVE-2026-92470 (High)
- CVE-2026-8937 (Medium)
- CVE-2026-10518 (Medium)
- CVE-2026-92529 (Medium)
- CVE-2026-92530 (Medium)
- CVE-2026-92874 (Medium)
- CVE-2026-4523 (Low)
- CVE-2026-92628 (Low)
Related articles
Google Releases Chrome 154 with 108 Security Fixes Including 11 Critical Vulnerabilities
Google has published Chrome 154 for Windows, macOS, and Linux, addressing a total of 108 vulnerabilities. Eleven of these issues are rated Critical, covering buffer overflows in ANGLE, out-of-bounds writes in GPU, and multiple Use-After-Free flaws in ServiceWorker, Fullscreen, WindowDialog, AdFilter, and WebGL. Twenty-five High-severity issues were also fixed, including authorization problems in extensions, improper UI rendering in SecurityIndicators, and race conditions plus type confusion in the V8 JavaScript engine. Additional Medium and Low severity fixes bring the total to 108 patched flaws across components such as PDFium and WebAudio. The update is being rolled out over the coming days and weeks. Specific CVEs addressed include CVE-2026-95350, CVE-2026-95357, and CVE-2026-95281.
WordPress Patches Critical Core Vulnerability CVE-2026-87902 Affecting All Versions from 4.7.0
WordPress has released patches for a critical vulnerability in the platform's core code, tracked as CVE-2026-87902 with a CVSS score of 9.2. The flaw impacts every version from 4.7.0 through 7.1.1, meaning virtually all unpatched installations remain exposed. Because the issue resides in the base system rather than plugins or themes, even sites without any extensions installed are at risk. The vulnerability allows an unauthenticated attacker to load arbitrary PHP files from outside theme directories, which can lead to remote code execution on certain server configurations. The bug was privately reported in July by researcher Robert Ressl through HackerOne and disclosed publicly on 22 September, with no confirmed exploitation observed so far. Administrators are urged to apply the updates immediately and keep automatic updates enabled.
Critical Microsoft SharePoint Vulnerability Allows Remote Code Execution via SafeControls Bypass
A vulnerability tracked as CVE-2026-65660 with a CVSS score of 8.8 affects Microsoft SharePoint Server 2016, SharePoint Server 2019, and Subscription Edition. The flaw permits an authenticated low-privileged attacker to achieve arbitrary code execution on on-premises servers. It stems from improper handling of quotes in attacker-controlled Register directives within the ToolPane component, bypassing the SafeControls mechanism. This allows registration of dangerous .NET classes followed by deserialization-based remote code execution. Microsoft released patches on August 11, 2026, and initially reported no public disclosure or exploitation. Publication of a detailed technical analysis has now increased the risk for unpatched installations.
Google Chrome Prepares Deferred Restart Feature to Apply Security Updates Without Disruption
Google is developing a queued restart capability for Chrome that lets the browser install updates after detecting user inactivity instead of forcing an immediate closure. The feature, tracked under the queued-restarts theme in Chromium code, offers users the choice to restart right away or wait for roughly five minutes of idle time. Chrome will automatically skip the restart if the browser is downloading files, playing audio or video, recording the screen, or using the camera. Notifications and a menu indicator labeled Scheduled Restart will inform users of the planned update, while additional reminders may appear when opening new tabs. The implementation currently lacks the ability to select a precise restart time like Windows Update and remains limited to the absence of activity. Google has previously committed to reducing the annoyance of mandatory browser restarts for security patches, though the feature has not yet reached the stable channel.