CVE-2026-110264

GitLab sacó el parche para CVE-2026-110264, gravedad 10 de 10: permite correr código en tu servidor sin iniciar sesión, en todas las versiones desde la 7.0 de 2014. Si parchaste el 12 de octubre por la falla anterior, vuelves a estar expuesto. Sí, otra vez. Lo que se sabe (The Hacker News y Bleepin…

Besonders kritisch: CVE-2026-110264 erreicht den maximalen CVSS-Wert von 10,0. Unter bestimmten Bedingungen können Angreifer ohne Anmeldung Schadcode auf GitLab-Servern ausführen. ⚠️ Betreiber eigener GitLab-Instanzen sollten dringend aktualisieren und ihre Systeme auf Angriffsspuren prüfen. Betrof…

Critical GitLab Vulnerability: CVE-2026-110264 (CVSS 10.0) GitLab disclosed a critical flaw on 21 October 2026 affecting self-managed GitLab Community and Enterprise Edition. Under certain conditions, an unauthenticated attacker could execute code through an integer overflow in the regular-expressi…

Gitlabda çıkan cvss skoru 10.0 olan zafiyeti 2 hafta önce çıkan zafiyetle karıştırmayın arkadaşlar. Yenisinin cve kodu cve-2026-110264 ve çok eski sürümlere kadar sömürülebiliyor.

#schwachstellen GitLab CE/EE: Kritische RCE-Schwachstelle CVE-2026-110264 mit CVSS 10.0 #cve2026110264 #gitlab #gitlabce #gitlabee https://t.co/F250H9ppAR

Fix these to stay safe 👇 Only patch/rotate if one of these applies to you. ☐ 1. Self-host GitLab? Update to 19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 / 19.1.9 / 19.0.10 / 18.11.13 (CVE-2026-110264, max severity, unauthenticated RCE) ☐ 2. Run PHP or WordPress? Confirm you're patched past Oct 21 (PHP2Shell,…

Self-hosting GitLab? Patch today. CVE-2026-110264 is a CVSS 10 unauthenticated RCE that reaches back to version 7.0. Fixed in 19.5.1, 19.4.3, 19.3.6, with backports down to 18.11.13. Hosted GitLab is already patched. https://t.co/4dvqToYg4Q #GitLab #DevOps #CyberSecurity

Attackers exploiting CVE-2026-110264 need zero credentials — a crafted regex submitted to a public GitLab API endpoint triggers arbitrary code execution on the server. From that foothold, harvested CI/CD tokens enable lateral movement into pipeline runners, Kubernetes clusters, and connected cloud…

【緊急】GitLab脆弱性CVE-2026-110264とは｜CVSS 10.0、7.0以降が対象 修正版とバージョン確認・更新手順 https://t.co/EsCv5JGCQW #IT #Security #cybersecurity

gitlab unauth code exec on the server, every self-managed version back to 7.0. the bug is an integer overflow when compiling a crafted regex, and the release notes ship the fix as a patch to the regexp engine in gitlabs bundled ruby. CVE-2026-110264, 10.0 gitlabs own detections are an onigmo native…

lesterlam/onigmo-cve-2026-110264: Reproduction lab for CVE-2026-110264 - the 16-bit ID overflow in Onigmo, the regexp engine Ruby bundles (GitLab CE/EE, CVSS 10.0). Standalone engine build + A/B against the vendor fix. Trigger condition only; no weaponised exploit.

farimazhar/GitLab2Safe-Defensive-Checker: 100% Defensive Scanner for CVE-2026-110264 GitLab Arbitrary File Write (PHP2Shell) - No exploit code, only version & patch detection for security teams and learners.

GitHub cross-source: TheGlitchFixer/gitlab-patch-check: Check whether your self-hosted GitLab version is patched against CVE-2026-110264 (CVSS 10.0 RCE) — companion script for The Homelab Fixer guide.

GitHub cross-source: bastet2036/gitlab-firing-range: Authorized loopback-only Docker firing range for CVE-2026-110264 (Onigmo regex integer-overflow, unauth RCE) research + detection engineering

bastet-ai/gitlab-firing-range: Authorized loopback-only Docker firing range for CVE-2026-110264 (Onigmo regex integer-overflow, unauth RCE) research + detection engineering

GitHub cross-source: xaviware/go-gitlab-cve-2026-110264-scanner: Fast, concurrent and non-intrusive exposure auditor in Go for GitLab CE/EE unauthenticated RCE (CVE-2026-110264 - CVSS 10.0)

GitHub cross-source: al4n4n/CVE-2026-110264: CVE-2026-110264: GitLab pre-auth RCE via Onigmo integer overflow in org-ruby. Docker-based validation, admin check script, attack surface analysis.

GitHub cross-source: TahuCryptsi/poc-gitlab-onigmo-cve-2026-110264: CVE-2026-110264 — GitLab Unauthenticated RCE (Onigmo regex repeat-ID overflow, CVSS 10.0). Docker-verified crash PoC on ruby 3.4.11 + measured heap analysis. Crash-level, non-weaponized.

GitHub cross-source: TahuCryptsi/gitlab-onigmo-check: Local detector for CVE-2026-110264 (GitLab Onigmo regex repeat-ID overflow, CVSS 10.0 unauth RCE). One-file Ruby check + real crash transcript.

GitHub cross-source: nh4ttruong/cve-2026-110264-poc: Benign PoC carrier for CVE-2026-110264

CVE-2026-110264 GitLab Unauthenticated RCE (CVSS 10) — submitted by /u/radcorp to r/cybersecurity [link] [comments]