A maximum-severity vulnerability in GitLab's Community and Enterprise editions is now under active exploitation, allowing unauthenticated attackers to achieve remote code execution through a maliciously crafted regular expression hidden in a CI/CD configuration file. The flaw, tracked as CVE-2026-97229, carries a perfect CVSS score of 10.0 and arrives alongside a cluster of equally urgent incidents: two actively exploited Ivanti Connect Secure bugs added to CISA's Known Exploited Vulnerabilities catalog, a Cisco SD-WAN authentication bypass used to deploy a custom malware framework, and a breach at the University of Copenhagen exposing data on roughly 525,000 people. Together, the incidents paint a picture of attackers moving faster than defenders can patch.
***
The convergence of these events underscores a trend security researchers have been tracking all year: the gap between vulnerability disclosure and real-world exploitation is collapsing. Google's Threat Intelligence Group has found that exploitation of known, disclosed vulnerabilities climbed from roughly 10.5 per month in 2025 to nearly 18 per month in 2026, a faster growth rate than the more modest rise in genuine zero-days. The GitLab flaw, alongside parallel campaigns hitting Gitea, Cisco, and Ivanti infrastructure, shows why enterprises can no longer treat patch cycles as a routine maintenance task rather than an emergency discipline.
A Perfect-10 Flaw in Critical Developer Infrastructure
GitLab's CVE-2026-97229 is about as severe as vulnerabilities get. The integer-overflow bug allows an unauthenticated attacker to trigger arbitrary code execution on a GitLab server simply by submitting a specially crafted regular expression within a CI/CD pipeline configuration, a feature used by millions of development teams to automate testing and deployment. Because GitLab instances frequently house proprietary source code, deployment credentials, and secrets management, successful exploitation can cascade into a full compromise of an organization's software supply chain.
Researchers confirmed exploitation began shortly after the vulnerability's disclosure, consistent with a broader pattern this year of attackers compressing the time between patch release and weaponized exploit code. GitLab has pushed emergency patches, but given the central role the platform plays in continuous integration and deployment workflows, security teams are being urged to treat unpatched instances as an active incident rather than a routine update backlog item.
The timing is notable: GitLab's flaw emerged in the same week that a Chinese-speaking threat actor known as Red Heron was found exploiting a separate critical remote-code-execution bug in Gitea, a competing Git hosting platform, within days of its own disclosure. That campaign reportedly hit organizations across five countries, stealing source code, credentials, and infrastructure information — a reminder that developer tooling itself has become one of the most attractive targets in the threat landscape.
Edge Devices Keep Falling
CISA's Known Exploited Vulnerabilities catalog grew again this week with two Ivanti Connect Secure flaws: CVE-2026-111357, an 8.8-severity privilege-escalation bug, and CVE-2026-118527, a lower-severity but still dangerous predictable-identifier issue that enables attacker-controlled file uploads. Researchers determined that attackers chained three separate Ivanti vulnerabilities together to achieve unauthenticated root access on affected appliances, a technique that has become a signature of sophisticated edge-device intrusions over the past two years.
Cisco infrastructure was hit on two fronts. A newly identified advanced persistent threat group, designated UAT-11473, exploited CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. Separately, CISA added CVE-2026-76418, an 8.6-severity flaw in Cisco Secure Firewall ASA and FTD software, to its exploited-vulnerabilities list after confirming that unauthenticated attackers could force affected devices into denial-of-service reload loops.
Edge devices — VPN gateways, firewalls, and SD-WAN controllers — have become the preferred entry point for sophisticated intrusions precisely because they sit at the network perimeter with privileged visibility, yet are often patched more slowly than internal systems. Google's data shows enterprise products, many of them edge and identity infrastructure, accounted for roughly 48% of all observed zero-days in 2025, and this week's activity suggests that trend has only deepened into 2026.
A University's Data, a Blockchain Firm's Breach
The University of Copenhagen disclosed that attackers who breached a test environment made off with personal data belonging to approximately 525,000 current and former members of the university community, including names, phone numbers, personal email addresses, and — for many individuals — Denmark's national identity CPR numbers. PIN codes tied to identification cards for roughly 20,000 staff and students were also compromised and have since been reissued. The university detected the intrusion on October 20, more than a week before public disclosure, underscoring how test and staging environments remain a persistent blind spot in enterprise security postures.
Blockchain analytics firm Chainalysis also disclosed a breach this week, describing an intrusion that used what the company called offensive agentic techniques to access internal systems and tools. Exposed data included customer names, email addresses, user IDs, and organizational roles. The company's characterization of the attack methodology — explicitly invoking agentic, AI-assisted tooling — is likely to fuel further debate over how quickly offensive AI capabilities are being operationalized by threat actors, even as most confirmed breaches this year still trace back to conventional vulnerability exploitation rather than novel AI-driven attack chains.
Cloud hosting provider Northflank separately warned customers to rotate credentials and secrets after a breach allowed unauthorized use of customers' AI API keys, an incident with potentially outsized consequences given that compromised keys can generate direct cloud and model-usage costs while also exposing proprietary application logic to attackers.
A Poisoned Extension Targets Developers Directly
Perhaps the most insidious incident of the week involved a counterfeit version of Anthropic's Claude Code extension, distributed through the Cursor code editor's extension marketplace for approximately 11 hours on October 29. The malicious package was engineered to establish persistent SSH backdoors on infected machines and may have reached as many as 5,000 developers before it was removed, representing a direct supply-chain threat to source code repositories, credentials, and downstream software builds.
The incident fits a growing pattern of attackers targeting the software supply chain at its most trusted layer: the tools developers use every day. Combined with the Gitea and GitLab exploitation this week, and a newly reported integer-overflow flaw in TeamViewer that could let a malicious support host execute code on a technician's system, the message to engineering organizations is consistent — package registries, extension marketplaces, remote-access tools, and CI/CD pipelines are now front-line targets, not peripheral concerns.
Security researchers note that marketplace vetting processes, even for well-known platforms, often cannot catch convincingly disguised malicious packages before they achieve meaningful distribution. Organizations are increasingly being advised to pin extension versions, monitor outbound SSH connections from developer workstations, and treat any newly installed tooling with the same scrutiny traditionally reserved for production dependencies.
Attackers are not necessarily finding more unknown flaws, they are turning public vulnerability information into working exploits far faster than before, and that is where the real damage is happening right now.
The Shrinking Window Between Disclosure and Exploitation
Taken together, this week's incidents illustrate a defining dynamic of 2026's threat landscape: it is not a flood of unprecedented zero-days overwhelming defenders, but the accelerating speed at which known, disclosed vulnerabilities are turned into working exploits. Google's Threat Intelligence Group reported that exploited zero-days rose only modestly, from an average of eight per month in 2025 to eleven per month through August 2026, while exploitation of disclosed n-day vulnerabilities grew far faster, nearly doubling over the same period.
Researchers believe large language models are playing a meaningful role in that acceleration, helping attackers compare patched and unpatched code, analyze vendor advisories, and adapt proof-of-concept exploit code at a pace that outstrips many organizations' patch-management cycles. VulnCheck data suggests the share of vulnerabilities actually exploited using AI-assisted discovery remains small in absolute terms, at roughly 1.3%, but those flaws tend to be more severe, with about half enabling remote code execution compared to roughly a quarter of vulnerabilities overall.
Sources
- https://research.njit.edu/cybersecurity/aggregator/sources/1
- https://thecyberwire.com/
- https://www.cybersecuritydive.com/
- https://www.securityweek.com/
- https://thehackernews.com/search/label/data%20breach
- https://thehackernews.com/search/label/Cyber%20Attack
- https://www.bleepingcomputer.com/news/security/
- https://www.securityweek.com/in-other-news-anthropic-breach-dispute-uefi-flaw-hits-most-servers-cloudflare-ai-data-leak/
- https://www.bleepingcomputer.com/tag/data-breach/
- https://www.securityweek.com/news/
- https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era
- https://www.csoonline.com/article/4230247/ai-accelerates-n-day-attacks-as-flaw-disclosures-and-exploits-double.html
Leave a Comment