GitLab has released patches for a critical vulnerability (CVE-2026-110264) rated CVSS 10.0 that allows unauthenticated remote code execution on self-managed servers across all versions since 7.0 (2014). The flaw stems from an integer overflow in GitLab’s patched version of the Ruby Onigmo regular-expression compiler, and while no exploitation has been reported so far, immediate updates are necessary as no workaround exists and multiple affected versions require upgrading.
https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html