Critical GitLab Flaw CVE-2026-110264 Allows Unauthenticated Remote Code Execution
GitLab has published fixes for a critical vulnerability that enables remote code execution without authentication on self-managed instances. The flaw, identified as CVE-2026-110264, received the maximum CVSS 10.0 score and currently has no available mitigation.
The root cause is an integer overflow in the regular expression compiler. A specially crafted expression causes the compiler to overflow, which under certain conditions leads to arbitrary code execution on the server. The attack can be launched over the network with no credentials and requires no user interaction.
The vulnerability affects all versions from 7.0 (released in 2014) onward in both the Community and Enterprise editions. Fixed releases include 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Organizations that applied the October 12 critical update remain unprotected, as that package only addressed the earlier CVE-2026-97229 (also CVSS 10.0) and covered versions 19.2 and later.
GitLab.com is already running the patched version. Tenants of GitLab Dedicated starting from 19.3.5-internal0 and 19.4.2-internal0 have received the update. Self-managed deployments require database migrations that will cause downtime on single-node instances.
The update bundle contains 12 CVEs in total. The critical issue was reported by researcher joaxcar through the company's HackerOne bug bounty program. Offensive security firms such as HackerSec treat maximum-severity flaws in CI/CD servers as high priority because these systems often store cloud credentials and sign production artifacts.
As of October 22, no exploitation attempts have been reported. The vulnerability does not yet appear in the NVD or CISA's list of actively exploited vulnerabilities. GitLab has published two detection rules focused on regex compiler crashes and repeated markup rendering errors for organizations unable to patch immediately.
Related articles
Mitigating PHP2Shell RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 on Legacy PHP 5.6 Stacks with Varnish, Docker and Apache mod_php
Two critical remote code execution vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) affect PHP before any application code executes, targeting the Zend Engine's longjmp() mechanism during OOM conditions and use-after-free issues with session upload progress. Official patches exist only for supported branches 8.2.35 and newer, leaving PHP 5.6 installations exposed, especially those using Apache with mod_php. An administrator of a high-traffic legacy enterprise application running PHP 5.6 inside Docker containers behind Varnish implemented a four-layer defense without rewriting the monolith. The approach disables session.upload_progress.enabled and sets memory_limit to -1 inside PHP, enforces strict cgroups memory limits and MaxConnectionsPerChild 1 in Apache, adds request-size and cookie-based blocks in Varnish VCL, and forces Connection: close on synthetic error responses. Testing revealed HTTP keep-alive drain issues and differing behavior between direct Apache requests and Varnish-routed traffic. The layered controls successfully neutralize both attack vectors while preserving production stability.
Node.js Fixes High-Severity Brotli Decoder Flaw Leading to Remote Code Execution
A high-severity vulnerability in the bundled Brotli decoder of Node.js allows out-of-bounds writes when processing attacker-controlled compressed data, potentially resulting in remote code execution. The flaw, tracked as CVE-2026-111497, affects all supported branches including 22.x, 24.x, and 26.x prior to the October 21, 2026 security release. Patched versions 22.23.4, 24.22.1, and 26.12.1 address the memory corruption issue that arises during Brotli decompression in services accepting third-party content. The same update resolves additional high-severity problems, notably hostname validation weaknesses in TLS. Organizations using unsupported branches such as 18.x, 20.x, 23.x, and 25.x must migrate to maintained releases, while those linking against system Brotli libraries should verify inclusion of upstream commit 0ed4268. Security teams are advised to audit all environments, including containers and CI pipelines, that process Brotli-encoded data.
PHP2Shell Vulnerabilities Targeted in Exploitation Attempts Four Days Before Public Disclosure
Amazon Threat Intelligence detected early exploitation attempts against PHP vulnerabilities on October 17, four days prior to the public disclosure and patch release. The activity was observed through the MadPot honeypot network, with initial requests originating from a commercial anonymization service. Additional probing with varied payloads occurred on October 21, indicating multiple threat actors were involved before fixes became available. OpenAI reported that researchers from the Calif team identified one critical flaw using GPT-5.6 Sol as part of the Patch the Planet initiative, while Wiz independently discovered and reported both issues. PHP developers prepared the patches with support from security researchers and infrastructure providers. Amazon advises organizations to investigate potential compromise traces dating back to at least October 17, as new proof-of-concept exploits appeared within hours of the advisory and were quickly deployed against company sensors.
Anatomy of HTC Sense Vulnerability: Bypassing FRP Lock on HTC U11 Plus Without PC
A detailed technical breakdown reveals how an old HTC U11 Plus running Android 8 or 9 can have its Factory Reset Protection bypassed after a forgotten pattern lock. The method uses the device's own email client and credential storage system to force a new PIN without any PC or external tools. Multiple standard bypass attempts failed due to HTC Sense restrictions, including muscle memory recovery, Google account removal, Find My Device, and bootloader unlocking. The working exploit leverages the Exchange account setup flow to trigger Credential Storage Bypass, which overrides FRP flags by prioritizing certificate requests over setup wizard locks. A combined fingerprint and PIN option then allows creation of a new credential that survives reboot and passes the post-reset Google verification. The technique exploits architectural priority conflicts between the Biometric Framework and FRP enforcement in HTC Sense firmware.