{"metadata": {"vulnerability": "CVE-2026-97229", "count": 771, "kinds": {"milestone": 35, "sighting": 287, "kev": 11, "other": 438}, "linked_omitted": 0}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0414", "record": "NCSC-2026-0414", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-08-04T15:48:18.829Z", "date_only": false, "value": "2026-08-04T15:48:18.829000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-08-04T15:48:18.829Z", "date_only": false, "value": "2026-08-04T15:48:18.829000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-08-04T15:48:18.829Z", "date_only": false, "value": "2026-08-04T15:48:18.829000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-08-04T17:01:22.074Z", "date_only": false, "value": "2026-08-04T17:01:22.074765+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-08-04T17:01:22.074Z", "date_only": false, "value": "2026-08-04T17:01:22.074765+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-08-04T17:01:22.074Z", "date_only": false, "value": "2026-08-04T17:01:22.074765+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-08-13T11:28:20.737Z", "date_only": false, "value": "2026-08-13T11:28:20.737000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.1.release_date", "linked_record": true}, {"timestamp": "2026-08-13T11:28:20.737Z", "date_only": false, "value": "2026-08-13T11:28:20.737000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.1.release_date", "linked_record": true}, {"timestamp": "2026-08-13T11:28:20.737Z", "date_only": false, "value": "2026-08-13T11:28:20.737000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.1.release_date", "linked_record": true}, {"timestamp": "2026-08-13T11:53:43.512Z", "date_only": false, "value": "2026-08-13T11:53:43.512678+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.1.discovery_date", "linked_record": true}, {"timestamp": "2026-08-13T11:53:43.512Z", "date_only": false, "value": "2026-08-13T11:53:43.512678+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.1.discovery_date", "linked_record": true}, {"timestamp": "2026-08-13T11:53:43.512Z", "date_only": false, "value": "2026-08-13T11:53:43.512678+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.1.discovery_date", "linked_record": true}, {"timestamp": "2026-08-25T01:30:34.719Z", "date_only": false, "value": "2026-08-25T01:30:34.719000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.2.release_date", "linked_record": true}, {"timestamp": "2026-08-25T01:30:34.719Z", "date_only": false, "value": "2026-08-25T01:30:34.719000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.2.release_date", "linked_record": true}, {"timestamp": "2026-08-25T01:53:26.192Z", "date_only": false, "value": "2026-08-25T01:53:26.192779+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.2.discovery_date", "linked_record": true}, {"timestamp": "2026-08-25T01:53:26.192Z", "date_only": false, "value": "2026-08-25T01:53:26.192779+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.2.discovery_date", "linked_record": true}, {"timestamp": "2026-09-09T11:21:05.360Z", "date_only": false, "value": "2026-09-09T11:21:05.360000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.3.release_date", "linked_record": true}, {"timestamp": "2026-09-09T11:21:05.360Z", "date_only": false, "value": "2026-09-09T11:21:05.360000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.3.release_date", "linked_record": true}, {"timestamp": "2026-09-09T11:31:19.834Z", "date_only": false, "value": "2026-09-09T11:31:19.834714+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.3.discovery_date", "linked_record": true}, {"timestamp": "2026-09-09T11:31:19.834Z", "date_only": false, "value": "2026-09-09T11:31:19.834714+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.3.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:04:45.296Z", "date_only": false, "value": "2026-09-23T23:04:45.296000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.1.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:04:45.296Z", "date_only": false, "value": "2026-09-23T23:04:45.296000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "vulnerabilities.1.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:04:45.296Z", "date_only": false, "value": "2026-09-23T23:04:45.296000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "vulnerabilities.1.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:04:45.296Z", "date_only": false, "value": "2026-09-23T23:04:45.296000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.1.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:04:45.296Z", "date_only": false, "value": "2026-09-23T23:04:45.296000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.3.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:04:45.296Z", "date_only": false, "value": "2026-09-23T23:04:45.296000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.5.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:04:45.296Z", "date_only": false, "value": "2026-09-23T23:04:45.296000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.5.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:04:45.296Z", "date_only": false, "value": "2026-09-23T23:04:45.296000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96067", "record": "RHSA-2026:96067", "field": "vulnerabilities.1.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:04:45.296Z", "date_only": false, "value": "2026-09-23T23:04:45.296000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96068", "record": "RHSA-2026:96068", "field": "vulnerabilities.1.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:04:45.296Z", "date_only": false, "value": "2026-09-23T23:04:45.296000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96120", "record": "RHSA-2026:96120", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:04:45.296Z", "date_only": false, "value": "2026-09-23T23:04:45.296000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96233", "record": "RHSA-2026:96233", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:04:45.296Z", "date_only": false, "value": "2026-09-23T23:04:45.296000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96235", "record": "RHSA-2026:96235", "field": "vulnerabilities.1.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:05:20.132Z", "date_only": false, "value": "2026-09-23T23:05:20.132000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:05:20.132Z", "date_only": false, "value": "2026-09-23T23:05:20.132000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:05:20.132Z", "date_only": false, "value": "2026-09-23T23:05:20.132000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:05:20.132Z", "date_only": false, "value": "2026-09-23T23:05:20.132000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:05:20.132Z", "date_only": false, "value": "2026-09-23T23:05:20.132000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.2.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:05:20.132Z", "date_only": false, "value": "2026-09-23T23:05:20.132000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.4.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:05:20.132Z", "date_only": false, "value": "2026-09-23T23:05:20.132000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.4.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:05:20.132Z", "date_only": false, "value": "2026-09-23T23:05:20.132000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96067", "record": "RHSA-2026:96067", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:05:20.132Z", "date_only": false, "value": "2026-09-23T23:05:20.132000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96068", "record": "RHSA-2026:96068", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:05:20.132Z", "date_only": false, "value": "2026-09-23T23:05:20.132000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96235", "record": "RHSA-2026:96235", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-09-23T23:20:51.276Z", "date_only": false, "value": "2026-09-23T23:20:51.276943+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:20:51.276Z", "date_only": false, "value": "2026-09-23T23:20:51.276943+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:20:51.276Z", "date_only": false, "value": "2026-09-23T23:20:51.276943+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:20:51.276Z", "date_only": false, "value": "2026-09-23T23:20:51.276943+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:20:51.276Z", "date_only": false, "value": "2026-09-23T23:20:51.276943+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.2.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:20:51.276Z", "date_only": false, "value": "2026-09-23T23:20:51.276943+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.4.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:20:51.276Z", "date_only": false, "value": "2026-09-23T23:20:51.276943+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.4.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:20:51.276Z", "date_only": false, "value": "2026-09-23T23:20:51.276943+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:96067", "record": "RHSA-2026:96067", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:20:51.276Z", "date_only": false, "value": "2026-09-23T23:20:51.276943+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:96068", "record": "RHSA-2026:96068", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:20:51.276Z", "date_only": false, "value": "2026-09-23T23:20:51.276943+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:96235", "record": "RHSA-2026:96235", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:21:10.955Z", "date_only": false, "value": "2026-09-23T23:21:10.955642+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.1.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:21:10.955Z", "date_only": false, "value": "2026-09-23T23:21:10.955642+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "vulnerabilities.1.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:21:10.955Z", "date_only": false, "value": "2026-09-23T23:21:10.955642+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "vulnerabilities.1.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:21:10.955Z", "date_only": false, "value": "2026-09-23T23:21:10.955642+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.1.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:21:10.955Z", "date_only": false, "value": "2026-09-23T23:21:10.955642+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.3.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:21:10.955Z", "date_only": false, "value": "2026-09-23T23:21:10.955642+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.5.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:21:10.955Z", "date_only": false, "value": "2026-09-23T23:21:10.955642+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.5.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:21:10.955Z", "date_only": false, "value": "2026-09-23T23:21:10.955642+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:96067", "record": "RHSA-2026:96067", "field": "vulnerabilities.1.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:21:10.955Z", "date_only": false, "value": "2026-09-23T23:21:10.955642+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:96068", "record": "RHSA-2026:96068", "field": "vulnerabilities.1.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:21:10.955Z", "date_only": false, "value": "2026-09-23T23:21:10.955642+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:96120", "record": "RHSA-2026:96120", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:21:10.955Z", "date_only": false, "value": "2026-09-23T23:21:10.955642+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:96233", "record": "RHSA-2026:96233", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-09-23T23:21:10.955Z", "date_only": false, "value": "2026-09-23T23:21:10.955642+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:96235", "record": "RHSA-2026:96235", "field": "vulnerabilities.1.discovery_date", "linked_record": true}, {"timestamp": "2026-09-24T10:04:47.421Z", "date_only": false, "value": "2026-09-24T10:04:47.421Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-97229", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-29T15:30:27.136Z", "date_only": false, "value": "2026-09-29T15:30:27.136000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.8.release_date", "linked_record": true}, {"timestamp": "2026-09-29T15:30:27.136Z", "date_only": false, "value": "2026-09-29T15:30:27.136000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.10.release_date", "linked_record": true}, {"timestamp": "2026-09-29T15:30:27.136Z", "date_only": false, "value": "2026-09-29T15:30:27.136000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.10.release_date", "linked_record": true}, {"timestamp": "2026-09-29T15:36:05.963Z", "date_only": false, "value": "2026-09-29T15:36:05.963000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.9.release_date", "linked_record": true}, {"timestamp": "2026-09-29T15:36:05.963Z", "date_only": false, "value": "2026-09-29T15:36:05.963000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.11.release_date", "linked_record": true}, {"timestamp": "2026-09-29T15:36:05.963Z", "date_only": false, "value": "2026-09-29T15:36:05.963000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.11.release_date", "linked_record": true}, {"timestamp": "2026-09-29T15:41:38.807Z", "date_only": false, "value": "2026-09-29T15:41:38.807723+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.9.discovery_date", "linked_record": true}, {"timestamp": "2026-09-29T15:41:38.807Z", "date_only": false, "value": "2026-09-29T15:41:38.807723+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.11.discovery_date", "linked_record": true}, {"timestamp": "2026-09-29T15:41:38.807Z", "date_only": false, "value": "2026-09-29T15:41:38.807723+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.11.discovery_date", "linked_record": true}, {"timestamp": "2026-09-29T15:44:25.449Z", "date_only": false, "value": "2026-09-29T15:44:25.449046+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.8.discovery_date", "linked_record": true}, {"timestamp": "2026-09-29T15:44:25.449Z", "date_only": false, "value": "2026-09-29T15:44:25.449046+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.10.discovery_date", "linked_record": true}, {"timestamp": "2026-09-29T15:44:25.449Z", "date_only": false, "value": "2026-09-29T15:44:25.449046+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.10.discovery_date", "linked_record": true}, {"timestamp": "2026-10-11T22:00:00Z", "date_only": false, "value": "2026-10-11T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-11T22:00:00Z", "date_only": false, "value": "2026-10-11T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-11T22:00:00Z", "date_only": false, "value": "2026-10-11T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "vulnerabilities.23.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-12T00:00:00Z", "date_only": false, "value": "2026-10-12T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1294", "record": "CERTFR-2026-AVI-1294", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-10-12T00:00:00Z", "date_only": true, "value": "2026-10-12", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1294", "record": "CERTFR-2026-AVI-1294", "field": "initial_release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-12T00:00:00Z", "date_only": false, "value": "2026-10-12T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1294", "record": "CERTFR-2026-AVI-1294", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-10-12T01:22:06Z", "date_only": false, "value": "2026-10-12T01:22:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-23", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "3df93a8e-1d6d-4451-83c4-3d530848f262", "url": "https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-23"}, {"timestamp": "2026-10-12T08:19:29.357Z", "date_only": false, "value": "2026-10-12T08:19:29.357662Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxo3houa4p2w", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "98b549f3-694e-4449-9c0e-3866ab33fa9c", "content": "A GitLab critical vulnerability, CVE-2026-97229 (CVSS 10.0), allows unauthenticated arbitrary code execution. Upgrade to GitLab 19.4.2 now.\n\n#GitLab #CVE202697229 #ArbitraryCodeExecution #CICD #DevSecOps #PatchNow #CyberSecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mxo3houa4p2w"}, {"timestamp": "2026-10-12T13:02:57.328Z", "date_only": false, "value": "2026-10-12T13:02:57.328574Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/whatsnew.fyi/post/3mxolckjrfl2l", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "934a9089-0658-4b6f-bbba-ee7e505c1570", "content": "GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8\n\nFixed an integer overflow in the CI/CD regular expression compiler that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in CI/CD configuration (CVE-2026-97229)", "url": "https://bsky.app/profile/whatsnew.fyi/post/3mxolckjrfl2l"}, {"timestamp": "2026-10-12T13:37:17.319Z", "date_only": false, "value": "2026-10-12T13:37:17.319206Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117428173567027903", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "01c02ca0-8db2-492d-b70b-8be822c3ca8d", "content": "GitLab security advisory. The standout CVE is a 10.0 critical CVE-2026-97229 - Integer Overflow issue in CI/CD Regular Expression Compiler impacts GitLab CE/EE\nhttps://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/\n#gitlab #cve", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117428173567027903"}, {"timestamp": "2026-10-12T13:39:19.456Z", "date_only": false, "value": "2026-10-12T13:39:19.456181Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/clinux.fr/post/3mxondufm6c22", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a9d0ea5e-8c24-43cf-bead-e821bde9587c", "content": "Sale temps pour les #gitlab  RCE non authentifi\u00e9e .... CVE-2026-97229\nGo patch !", "url": "https://bsky.app/profile/clinux.fr/post/3mxondufm6c22"}, {"timestamp": "2026-10-12T14:10:04.185Z", "date_only": false, "value": "2026-10-12T14:10:04.185386Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mxop2kkgfs2i", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "345a9163-3b6b-4919-b469-3bf02040b76d", "content": "GitLab Patches CVE-2026-97229: Maximum-Severity RCE in CI/CD Regex Compiler", "url": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mxop2kkgfs2i"}, {"timestamp": "2026-10-12T14:22:41.959Z", "date_only": false, "value": "2026-10-12T14:22:41.959701Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mxopr5krtl2p", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "15930030-c2ec-4d1c-a4ed-50163f72cc40", "content": "GitLab CVE-2026-97229 lets attackers run code without login\u2014patch your servers now. #GitLab #CVE2026-97229 #Security #CI/CD #Vulnerability #CodeExecution https://thedailytechfeed.com/critical-gitlab-flaw-opens-door-to-remote-code-execution/", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mxopr5krtl2p"}, {"timestamp": "2026-10-12T16:01:37.605Z", "date_only": false, "value": "2026-10-12T16:01:37.605437Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxovc2ouuw25", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "186c7af0-82fc-405a-94da-f93a3205e2d0", "content": "~Certeu~\nUnauthenticated RCE affects self-managed GitLab; upgrade to 19.4.2, 19.3.4, or 19.2.8.\n-\nIOCs: CVE-2026-97229, CVE-2026-92883, CVE-2026-16301\n-\n#CVE-2026-97229 #GitLab #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mxovc2ouuw25"}, {"timestamp": "2026-10-12T17:24:18.909Z", "date_only": false, "value": "2026-10-12T17:24:18.909192Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/some-rss-feeds.bsky.social/post/3mxozvvrvmv2m", "record": "cve-2026-97229", "field": "creation_timestamp", "uuid": "b83ece1b-25cd-4f8b-a7af-6cfa1e53579c", "content": "[some-subscribed-rss] New Post: GitLab Patches Critical Remote Code Execution Flaw, by Jeremy https://noted.lol/gitlab-critical-rce-cve-2026-97229/", "url": "https://bsky.app/profile/some-rss-feeds.bsky.social/post/3mxozvvrvmv2m"}, {"timestamp": "2026-10-12T17:49:12.023Z", "date_only": false, "value": "2026-10-12T17:49:12.023699Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxp3cg7ikd2l", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "6981e47c-6d98-4abe-9a03-8a4857ecc5bc", "content": "\ud83e\udd16 CVE-2026-97229 (CVSS 10.0): unauthenticated RCE in GitLab's CI/CD regex compiler via a crafted regex in pipeline config. Fixed in 19.2.8, 19.3.4, 19.4.2.\nhttps://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxp3cg7ikd2l"}, {"timestamp": "2026-10-12T17:56:59.728Z", "date_only": false, "value": "2026-10-12T17:56:59.728961Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/redsiege.com/post/3mxp3qcwjfk2z", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "494a74b5-97e3-4f23-b4a6-e253a3e0ec85", "content": "GitLab is urging users to patch a critical vulnerability (CVE-2026-97229) that could allow unauthenticated attackers to remotely execute code. Fixes are available for affected versions.\n\nvia @bleepingcomputer.com \n\nwww.bleepingcomputer.com/news/securit...", "url": "https://bsky.app/profile/redsiege.com/post/3mxp3qcwjfk2z"}, {"timestamp": "2026-10-12T18:00:00Z", "date_only": false, "value": "2026-10-12T18:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities_20261013", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "6d4e12ce-e439-438b-bb68-a02911f91b2e", "url": "https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities_20261013"}, {"timestamp": "2026-10-12T18:15:47.489Z", "date_only": false, "value": "2026-10-12T18:15:47.489416Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxp4rx4vps2h", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4c60ebff-faab-4a5b-b5f0-6bb77f3dfa0b", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-102255 \u00b7 10 people\n2. CVE-2026-85097 \u00b7 8 people\n3. CVE-2026-97229 \u00b7 7 people\n4. CVE-2026-78357 \u00b7 5 people\n5. CVE-2026-93582 \u00b7 5 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxp4rx4vps2h"}, {"timestamp": "2026-10-12T18:15:48.842Z", "date_only": false, "value": "2026-10-12T18:15:48.842864Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxp4rxbwu22h", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "348ebf6b-f806-4d0a-bf56-28d2bc754cc6", "content": "3. CVE-2026-97229 \u00b7 7 people\n\nNo published details yet (the CVE may still be reserved).", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxp4rxbwu22h"}, {"timestamp": "2026-10-12T19:30:21.892Z", "date_only": false, "value": "2026-10-12T19:30:21.892694Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bearstech.com/post/3mxpaxcztdy2n", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "cb894aba-2e18-425f-bcb4-7996f676b595", "content": "Toutes les instances GitLab de nos clients sont \u00e0 jour version 19.4.2\n\nCette mise \u00e0 jour critique vient corriger 24 vuln\u00e9rabilit\u00e9s de s\u00e9curit\u00e9, dont une faille critique not\u00e9e CVSS 10.0 (CVE-2026-97229)\n\nEn savoir plus sur notre offre, contactez nous \ud83d\udc47", "url": "https://bsky.app/profile/bearstech.com/post/3mxpaxcztdy2n"}, {"timestamp": "2026-10-12T19:30:27.010Z", "date_only": false, "value": "2026-10-12T19:30:27.010161Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bearstech.com/post/3mxpaxhyztb2w", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4d18e64c-8994-4b58-914a-38e52415b718", "content": "En savoir plus sur cette mise \u00e0 jour \ud83d\udc49 docs.gitlab.com/rele...\n\nEn savoir plus sur la CVE-2026-97229 not\u00e9e CVSS 10.0 \ud83d\udc49 gitlab-com.gitlab.io...\n\nTak @joaxcar.bsky.social \ud83d\udc49 hackerone.com/joaxcar", "url": "https://bsky.app/profile/bearstech.com/post/3mxpaxhyztb2w"}, {"timestamp": "2026-10-12T20:24:28.169Z", "date_only": false, "value": "2026-10-12T20:24:28.169373Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxpdy2btmc2n", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a4cfb5b4-817c-4626-a58c-88713c514259", "content": "GitLab patched CVE-2026-97229, a critical integer overflow in its CI/CD regular expression compiler that could let unauthenticated attackers execute code. Self-managed installations should upgrade; GitLab.com is patched.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxpdy2btmc2n"}, {"timestamp": "2026-10-12T22:00:00Z", "date_only": false, "value": "2026-10-12T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-12T22:33:04.719Z", "date_only": false, "value": "2026-10-12T22:33:04.719324Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cloud/statuses/117429196639727551", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "c8073892-7492-40bf-8f3f-1dd29306f12b", "content": "\ud83e\udd16 CVE-2026-97229 (CVSS 10.0): unauthenticated RCE in GitLab's CI/CD regex compiler \u2014 integer overflow / insufficient regex validation, triggered by a crafted regex in a pipeline config. Fixed in 19.2.8, 19.3.4, 19.4.2. Self-managed instances should patch now.\ud83d\udd17 https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/#CVE #RCE #GitLab #CyberSec", "url": "https://infosec.exchange/users/cloud/statuses/117429196639727551"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-97229", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-97229", "record": "FKIE_CVE-2026-97229", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-13T00:24:47Z", "date_only": false, "value": "2026-10-13T00:24:47.000000Z", "kind": "sighting", "label": "Seen", "source": "https://ccb.belgium.be/advisories/warning-critical-vulnerability-gitlab-ceee-patch-immediately", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "d5de1e88-c3bf-4c39-9bba-92b58824bb31", "url": "https://ccb.belgium.be/advisories/warning-critical-vulnerability-gitlab-ceee-patch-immediately"}, {"timestamp": "2026-10-13T01:05:24Z", "date_only": false, "value": "2026-10-13T01:05:24.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.dk/news/2026-10-13/GitLab-advarer-om-kritisk-saarbarhed", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "0a6baa95-b2e7-4d8a-98d5-ba98da03f813", "url": "https://www.cert.dk/news/2026-10-13/GitLab-advarer-om-kritisk-saarbarhed"}, {"timestamp": "2026-10-13T01:05:46.166Z", "date_only": false, "value": "2026-10-13T01:05:46.166Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-97229", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-13T01:05:46.166Z", "date_only": false, "value": "2026-10-13T01:05:46.166000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.2.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T01:05:46.166Z", "date_only": false, "value": "2026-10-13T01:05:46.166000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "vulnerabilities.2.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T01:05:46.166Z", "date_only": false, "value": "2026-10-13T01:05:46.166000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "vulnerabilities.2.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T01:05:46.166Z", "date_only": false, "value": "2026-10-13T01:05:46.166000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.2.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T01:05:46.166Z", "date_only": false, "value": "2026-10-13T01:05:46.166000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.7.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T01:05:46.166Z", "date_only": false, "value": "2026-10-13T01:05:46.166000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.9.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T01:05:46.166Z", "date_only": false, "value": "2026-10-13T01:05:46.166000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.9.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T01:05:46.166Z", "date_only": false, "value": "2026-10-13T01:05:46.166000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96067", "record": "RHSA-2026:96067", "field": "vulnerabilities.2.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T01:05:46.166Z", "date_only": false, "value": "2026-10-13T01:05:46.166000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96068", "record": "RHSA-2026:96068", "field": "vulnerabilities.2.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T01:05:46.166Z", "date_only": false, "value": "2026-10-13T01:05:46.166000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96120", "record": "RHSA-2026:96120", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T01:05:46.166Z", "date_only": false, "value": "2026-10-13T01:05:46.166000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96233", "record": "RHSA-2026:96233", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T01:05:46.166Z", "date_only": false, "value": "2026-10-13T01:05:46.166000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96235", "record": "RHSA-2026:96235", "field": "vulnerabilities.2.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T01:05:46.166Z", "date_only": false, "value": "2026-10-13T01:05:46.166Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitLab", "record": "CVE-2026-97229", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T01:45:31.887Z", "date_only": false, "value": "2026-10-13T01:45:31.887793Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mxpvw5f26d2n", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "22b9b441-c99a-4b32-a391-0a0c5ac6497b", "content": "\u26a0\ufe0f PATCH NOW\n\nA crafted regex in a CI/CD config can run code on a self-managed GitLab server. No login required.\n\nGitLab CVE-2026-97229 is a CVSS 10 unauthenticated RCE. GitLab.com is already patched; self-hosted is the exposure.\n\nPatch to 19.4.2, 19.3.5, or 19.2.8 now.", "url": "https://bsky.app/profile/suriq.io/post/3mxpvw5f26d2n"}, {"timestamp": "2026-10-13T02:00:04.658Z", "date_only": false, "value": "2026-10-13T02:00:04.658761Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxpwq6klok2l", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "077a0ac9-080d-4d90-80d2-77afc33babae", "content": "CVE-2026-97229 - gitlab\nAll supported versions of GitLab Community and Enterprise Edition can be tricked by a specially crafted regular expression in a CI/CD configuration. An attacker without any login could cause\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gitlab #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxpwq6klok2l"}, {"timestamp": "2026-10-13T02:00:49.273Z", "date_only": false, "value": "2026-10-13T02:00:49.273654Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sansisc.bsky.social/post/3mxpwrj5qvm2c", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a77ccffc-fc6e-43df-84ab-e4e2136827e0", "content": "SANS Stormcast Tuesday, October 13th, 2026: GitLab CI/CD RCE (CVE-2026-97229); Let\u2019s Encrypt 64-Day Certificates; Midnight Mimosa Pre-Installed Android Malware; Progress MarkLogic Patches\n https://isc.sans.edu/podcastdetail/10134", "url": "https://bsky.app/profile/sansisc.bsky.social/post/3mxpwrj5qvm2c"}, {"timestamp": "2026-10-13T02:00:54.492Z", "date_only": false, "value": "2026-10-13T02:00:54.492766Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxpwroal5u2t", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a29a7429-0007-42cf-a35f-0d1cc0a86c98", "content": "\ud83e\udd16 CVE-2026-97229: unauthenticated RCE in GitLab's CI/CD regex compiler via an integer overflow. Patch self-managed instances (19.2.8/19.3.4/19.4.2).\nhttps://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxpwroal5u2t"}, {"timestamp": "2026-10-13T02:12:46.708Z", "date_only": false, "value": "2026-10-13T02:12:46.708369Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117431177458331377", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "bc851928-158f-436c-a6f0-a2681a6d54d5", "content": "CVE-2026-97229 Integer Overflow or Wraparound in GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.\nhttps://www.cve.org/CVERecord?id=CVE-2026-97229https://gitlab.com/gitlab-org/gitlab/-/work_items/630686https://hackerone.com/reports/4055749https://hackerone.com/reports/4058589https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/#gitlab #GitLab#CVE_2026_97229#bot", "url": "https://infosec.exchange/users/cve/statuses/117431177458331377"}, {"timestamp": "2026-10-13T02:17:00Z", "date_only": false, "value": "2026-10-13T02:17:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9HJ5-R43H-H3XG", "record": "GHSA-9HJ5-R43H-H3XG", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-13T02:17:00Z", "date_only": false, "value": "2026-10-13T02:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-97229", "record": "UBUNTU-CVE-2026-97229", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T02:17:00.840Z", "date_only": false, "value": "2026-10-13T02:17:00.840", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-97229", "record": "FKIE_CVE-2026-97229", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T02:39:58Z", "date_only": false, "value": "2026-10-13T02:39:58.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0414", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "cc99d51e-3cae-4c14-aafd-4918f4f3023f", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0414"}, {"timestamp": "2026-10-13T02:50:00Z", "date_only": false, "value": "2026-10-13T02:50:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.se/2026/10/gitlab-rattar-kritisk-sarbarhet.html", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "1bdfd24a-052f-48ff-9537-664a547b6df3", "url": "https://www.cert.se/2026/10/gitlab-rattar-kritisk-sarbarhet.html"}, {"timestamp": "2026-10-13T03:30:36Z", "date_only": false, "value": "2026-10-13T03:30:36Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9HJ5-R43H-H3XG", "record": "GHSA-9HJ5-R43H-H3XG", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T03:48:05.255Z", "date_only": false, "value": "2026-10-13T03:48:05.255718Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxq4rc7hek2k", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "72e29844-7ba8-48bb-978f-a2a538a89543", "content": "\ud83d\udd34 CVE-2026-97229 - Critical (10)\n\nGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-97229/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxq4rc7hek2k"}, {"timestamp": "2026-10-13T03:49:12.946Z", "date_only": false, "value": "2026-10-13T03:49:12.946519Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3hjo3uj35haga", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "88a67b2d-c354-449f-ad7f-ea066ba291fd", "content": "CVE-2026-97229 - Integer Overflow or Wraparound in GitLab\nCVE ID : CVE-2026-97229\n \n Published : Oct. 13, 2026, 2:17 a.m. | 13\u00a0minutes ago\n \n Description : GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3hjo3uj35haga"}, {"timestamp": "2026-10-13T04:07:59Z", "date_only": false, "value": "2026-10-13T04:07:59.000547Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxq5uvjn442o", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "9b925116-375f-4d33-bebd-c8301cdc5737", "content": "\ud83d\udea8 CVE-2026-97229 \u2014 CVSS 10 CRITICAL\n\nGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-97229\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxq5uvjn442o"}, {"timestamp": "2026-10-13T05:22:22Z", "date_only": false, "value": "2026-10-13T05:22:22.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/3354", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ad48b4ae-5eb0-44c5-91df-986f349d2223", "content": "GITLAB CRITICAL PATCH: UNAUTHENTICATED RCE VIA CI/CD REGEX COMPILER (CVE-2026-97229)\n\nGitLab released Critical patch versions 19.4.2, 19.3.5, and 19.2.8 on October 12, 2026 for Community Edition and Enterprise Edition.", "url": "https://t.me/CyberDispatch/3354"}, {"timestamp": "2026-10-13T05:22:22Z", "date_only": false, "value": "2026-10-13T05:22:22.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/3355", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "c0490971-f88b-4043-8443-84735b516a1f", "content": "\u2022 CVE-2026-97229 \u2014 integer overflow in the CI/CD Regular Expression Compiler; CVSS 10.0\n\u2022 Unauthenticated attacker can execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration\n\u2022 Impacted: CE/EE from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2\n\u2022 Fixed: upgrade to 19.4.2, 19.3.5, or 19.2.8 immediately\n\u2022 http://GitLab.com is already running the patched version; GitLab Dedicated customers need no action\n\u2022 Same release also fixes additional High/Medium/Low issues (XSS, authz, Pages token exposure, and more)", "url": "https://t.me/CyberDispatch/3355"}, {"timestamp": "2026-10-13T05:39:57Z", "date_only": false, "value": "2026-10-13T05:39:57.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/Russian_OSINT/8038", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "6410aa71-d40e-4f6d-968a-a0c24882c19c", "content": "\u2757\ufe0f\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 GitLab \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0443\u0442\u044c \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 \u0432\u0435\u0440\u0441\u0438\u0439 19.4.2, 19.3.4 \u0438 19.2.8 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0446\u0438\u0439 Community Edition \u0438 Enterprise Edition. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-97229 \u0441 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 10,0 \u0431\u0430\u043b\u043b\u043e\u0432 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS. \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0446\u0435\u043b\u044b\u0445 \u0447\u0438\u0441\u0435\u043b \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u0438 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 CI/CD \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445, \u043e \u0447\u0451\u043c \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u043e \u0438\u0437\u0434\u0430\u043d\u0438\u0435 BleepingComputer.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0418\u0411-\u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u043e\u0434 \u043f\u0441\u0435\u0432\u0434\u043e\u043d\u0438\u043c\u043e\u043c joaxcar, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u043b \u043e\u0442\u0447\u0451\u0442 \u0447\u0435\u0440\u0435\u0437 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0432\u044b\u043f\u043b\u0430\u0442\u044b \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0437\u0430 \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 HackerOne. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043b\u043e\u043a\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 CI/CD Regular Expression Compiler, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0435\u043c \u0437\u0430 \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437, \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u044e \u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440\u043e\u0432. \u0418\u0437-\u0437\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044e \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e CI/CD \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u0435 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u0431\u0435\u0437 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u0412\u043c\u0435\u0441\u0442\u0435 \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 GitLab \u0437\u0430\u043a\u0440\u044b\u043b\u0438 \u0440\u044f\u0434 \u0434\u0440\u0443\u0433\u0438\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u0432\u044b\u0434\u0435\u043b\u044f\u044e\u0442\u0441\u044f \u043c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u044b\u0439 \u0441\u043a\u0440\u0438\u043f\u0442\u0438\u043d\u0433 CVE-2026-92883 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043f\u043e\u0434\u0441\u0432\u0435\u0442\u043a\u0438 \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0441\u0430 \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSS 8,7, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u043e\u043e\u0431\u0449\u0438\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c a0xnirudh, \u0438 \u043e\u0448\u0438\u0431\u043a\u0430 \u0440\u0430\u0437\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 CVE-2026-16301 \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0434\u043e\u0447\u0435\u0440\u043d\u0438\u0445 \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440\u043e\u0432. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044f\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-96893 \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 GitLab Duo Agent Platform, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0430 \u043f\u0440\u043e\u043c\u043f\u0442\u043e\u0432 \u0434\u043b\u044f \u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u044f\u0437\u044b\u043a\u043e\u0432\u044b\u0445 \u043c\u043e\u0434\u0435\u043b\u0435\u0439.\n\n\ud83d\udc46\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0441\u0432\u044b\u0448\u0435 30 \u043c\u043b\u043d \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0431\u043e\u043b\u0435\u0435 50% \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u0439 \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430 Fortune 100, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Nvidia, T-Mobile, Lockheed Martin, Airbus \u0438 Goldman Sachs. \u041e\u0431\u043b\u0430\u0447\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 GitLab[.]com \u0443\u0436\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0451\u043d \u0434\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 GitLab Dedicated \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439. \u0412\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0432\u0442\u043e\u043d\u043e\u043c\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0439 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0430\u0442\u0447\u0438 \u0432 \u0441\u0440\u043e\u0447\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435.\n\n\u270b @Russian_OSINT", "url": "https://t.me/Russian_OSINT/8038"}, {"timestamp": "2026-10-13T05:53:48.911Z", "date_only": false, "value": "2026-10-13T05:53:48.911080Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxqds4x7b42f", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4aae626d-a506-4487-9cbc-2d87a372dcfd", "content": "GitLab\u306b\u91cd\u5927\u306a\u8106\u5f31\u6027\u3001\u8a8d\u8a3c\u306a\u3057\u306e\u653b\u6483\u8005\u304c\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u53ef\u80fd\u306b\n\nGitLab\u306f\u3001\u8a8d\u8a3c\u306a\u3057\u306e\u653b\u6483\u8005\u304c\u5f71\u97ff\u3092\u53d7\u3051\u308b\u30b5\u30fc\u30d0\u30fc\u4e0a\u3067\u4efb\u610f\u306e\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u91cd\u5927\u306a\u8106\u5f31\u6027\u306b\u5bfe\u51e6\u3059\u308b\u305f\u3081\u3001\u7dca\u6025\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u516c\u958b\u3057\u307e\u3057\u305f\u3002CVE\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u3078\u306e\u30a2\u30af\u30bb\u30b9 \u3053\u306e\u8106\u5f31\u6027\u306f\u300cCVE-2026-97229\u300d\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u304a\u308a\u3001CVSS\u30b9\u30b3\u30a2\u306f\u6700\u9ad8\u5024\u306e10.0\u3068\u8a55\u4fa1\u3055\u308c\u3066\u3044\u307e\u3059\u3002", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxqds4x7b42f"}, {"timestamp": "2026-10-13T06:43:41Z", "date_only": false, "value": "2026-10-13T06:43:41.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.ncsc.nl/alerts/kwetsbaarheden-in-gitlab-ce-en-ee-update-nu", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "670a34ed-9edd-47ab-a6df-0c976e37165b", "url": "https://www.ncsc.nl/alerts/kwetsbaarheden-in-gitlab-ce-en-ee-update-nu"}, {"timestamp": "2026-10-13T08:10:36.982Z", "date_only": false, "value": "2026-10-13T08:10:36.982444Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mxqlgpevey2l", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "992bcf8e-43c6-4eab-a86d-604077f2351a", "content": "COGNOSCERE Tech Brief \u2014 2026-10-13\n\nGitLab shipped emergency patches Sunday for CVE-2026-97229, a CVSS 10.0 unauthen\n\nhttps://youtube.com/watch?v=srOSDbJj2K4\n\nhttps://www.cognoscerellc.com/news", "url": "https://bsky.app/profile/billingsley.bsky.social/post/3mxqlgpevey2l"}, {"timestamp": "2026-10-13T08:22:40.866Z", "date_only": false, "value": "2026-10-13T08:22:40.866071Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mxqm4d56tu26", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "8731249e-42c0-443a-8e5d-38af11de5a9f", "content": "Top 3 CVE for last 7 days:\nCVE-2026-21589: 79 interactions\nCVE-2026-102255: 21 interactions\nCVE-2026-107406: 14 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-97229: 14 interactions\nCVE-2026-92392: 7 interactions\nCVE-2025-41450: 5 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mxqm4d56tu26"}, {"timestamp": "2026-10-13T08:48:22Z", "date_only": false, "value": "2026-10-13T08:48:22.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/10307", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "18ab0310-0dd0-433d-94fc-6a9966b0d80c", "content": "\u203c\ufe0f A CVSS 10.0 flaw in GitLab could have let unauthenticated users execute code on the server under certain conditions.\n\nGitLab has patched the CI/CD vulnerability (CVE-2026-97229) affecting CE and EE.\n\nFixed versions: 19.2.8, 19.3.5, and 19.4.2.\n\nRead: https://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.html", "url": "https://t.me/thehackernews/10307"}, {"timestamp": "2026-10-13T09:00:08Z", "date_only": false, "value": "2026-10-13T09:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105131", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4ccd639d-e943-406f-8faa-2a161d8b8d2d", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AmpedWasTaken\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-13 08:51:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-97229 \u2014 GitLab CI/CD Regex Compiler RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105131", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-13T09:21:30.002Z", "date_only": false, "value": "2026-10-13T09:21:30.002624Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxqpfiqwhi2g", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a2589fc7-d5ef-4f39-85ea-27b38e241a21", "content": "GitLab CVE-2026-97229 max-severity RCE lets unauthenticated attackers run code via a crafted CI/CD regex. Self-managed 19.2 to 19.4 must upgrade to 19.2.8, 19.3.4 or 19.4.2 now. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxqpfiqwhi2g"}, {"timestamp": "2026-10-13T09:23:23.572Z", "date_only": false, "value": "2026-10-13T09:23:23.572679Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mxqpirzk4y24", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "54b371e7-9986-45a9-9943-46bd25cfd7b5", "content": "GitLab released patches for CVE-2026-97229, a maximum-severity flaw enabling unauthenticated arbitrary code execution via insufficient CI/CD regular expression validation.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mxqpirzk4y24"}, {"timestamp": "2026-10-13T09:26:37.099Z", "date_only": false, "value": "2026-10-13T09:26:37.099954Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mxqpok2kc22q", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "7ad6cdf3-2ea9-4911-967c-9a895c00a1e0", "content": "GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)\n\n\ud83d\udd17 Read more: www.helpnetsecurity.com/2026/10/13/g...\n\n#GitLab #vulnerability #cybersecurity", "url": "https://bsky.app/profile/helpnetsecurity.com/post/3mxqpok2kc22q"}, {"timestamp": "2026-10-13T09:29:39.768Z", "date_only": false, "value": "2026-10-13T09:29:39.768266Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mxqpu2qkdt2a", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "30d931a2-74af-46aa-90dd-9033efa94f16", "content": "GitLab released patches for CVE-2026-97229, a maximum-severity flaw enabling unauthenticated arbitrary code execution via insufficient CI/CD regular expression validation.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mxqpu2qkdt2a"}, {"timestamp": "2026-10-13T09:29:44.071Z", "date_only": false, "value": "2026-10-13T09:29:44.071128Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/javascriptbriefly.bsky.social/post/3mxqpua6fr52n", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "92bc099e-1d3b-40c2-990b-e04219efd16d", "content": "GitLab released patches for CVE-2026-97229, a maximum-severity flaw enabling unauthenticated arbitrary code execution via insufficient CI/CD regular expression validation.\n", "url": "https://bsky.app/profile/javascriptbriefly.bsky.social/post/3mxqpua6fr52n"}, {"timestamp": "2026-10-13T09:29:59.492Z", "date_only": false, "value": "2026-10-13T09:29:59.492918Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxqpuooc3z2i", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "41ddd456-7266-403d-99d6-6272683cd489", "content": "GitLab\u306e\u7ba1\u7406\u8005\u306b\u7dca\u6025\u30d1\u30c3\u30c1\u9069\u7528\u3092\u547c\u3073\u304b\u3051\u3001\u91cd\u5927\u306aRCE\u8106\u5f31\u6027\uff08CVE-2026-97229\uff09\n\nGitLab\u306f\u3001\u30bb\u30eb\u30d5\u30de\u30cd\u30fc\u30b8\u30c9\u7248\u306e\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u3092\u5229\u7528\u3057\u3066\u3044\u308b\u30e6\u30fc\u30b6\u30fc\u306b\u5bfe\u3057\u3001CI/CD\u306e\u6b63\u898f\u8868\u73fe\u30b3\u30f3\u30d1\u30a4\u30e9\u30fc\u306b\u5b58\u5728\u3059\u308b\u91cd\u5927\u306a\u8106\u5f31\u6027\uff08CVE-2026-97229\uff09\u3078\u306e\u30d1\u30c3\u30c1\u9069\u7528\u3092\u5f37\u304f\u547c\u3073\u304b\u3051\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3055\u308c\u308b\u3068\u3001\u30ea\u30e2\u30fc\u30c8\u306e\u653b\u6483\u8005\u304cGitLab\u30b5\u30fc\u30d0\u30fc\u4e0a\u3067\u4efb\u610f\u306e\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u308b\u6050\u308c\u304c\u3042", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxqpuooc3z2i"}, {"timestamp": "2026-10-13T09:39:58.905Z", "date_only": false, "value": "2026-10-13T09:39:58.905563Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0414", "record": "NCSC-2026-0414", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-13T09:39:58.905Z", "date_only": false, "value": "2026-10-13T09:39:58.905563Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0414", "record": "NCSC-2026-0414", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T09:39:58.905Z", "date_only": false, "value": "2026-10-13T09:39:58.905563Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0414", "record": "NCSC-2026-0414", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-10-13T09:48:44.291Z", "date_only": false, "value": "2026-10-13T09:48:44.291051Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mxqqw6b6xq27", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "d7d837cd-cfee-4b9d-affc-c38bcf483afe", "content": "GitLab released urgent security updates on October 12, 2026, to address a critical vulnerability (CVE-2026-97229) allowing arbitrary code execution on servers without authentication. The flaw, with a CVSS score of 10.", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mxqqw6b6xq27"}, {"timestamp": "2026-10-13T09:59:39.608Z", "date_only": false, "value": "2026-10-13T09:59:39.608514Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mxqrjnx6qo2y", "record": "cve-2026-97229", "field": "creation_timestamp", "uuid": "5abba350-5aee-436a-9ada-f15a238df254", "content": "\ud83d\udcf0 GitLab Peringatkan Celah RCE Kritis CVE-2026-97229 dengan Skor CVSS 10.0, Pengguna Diminta Segera Update\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/13/gitlab-cve-2026-97229-celah-rce-kritis-cvss-10/\n\n#cve #cybersecurity #devsecops #gitlab #hacker #keamananSiber #rce #remo", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mxqrjnx6qo2y"}, {"timestamp": "2026-10-13T10:11:55.829Z", "date_only": false, "value": "2026-10-13T10:11:55.829538Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxqs7omhat2n", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "3be768c9-f6ab-4c37-9cbf-ba5db8298b66", "content": "\ud83e\udd16 CVE-2026-97229 (CVSS 10.0): unauthenticated RCE on GitLab CE/EE via a crafted regex in a CI/CD config. Fixed in 19.4.2/19.3.5/19.2.8.\nhttps://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxqs7omhat2n"}, {"timestamp": "2026-10-13T10:52:50.423Z", "date_only": false, "value": "2026-10-13T10:52:50.423963Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mxquisjzbk2n", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "0d2fbeb0-2de6-467e-b99e-b2d60b5a0e14", "content": "GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)\n\nwww.helpnetsecurity.com/2026/10/13/g...\n\n#Kyberturvallisuus #Kyber #Tilannekuva", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mxquisjzbk2n"}, {"timestamp": "2026-10-13T11:30:06Z", "date_only": false, "value": "2026-10-13T11:30:06.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8706", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a44aa140-2d24-4812-ad8d-08136940ba10", "content": "GitLab \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0440\u043e\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0432 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 CI/CD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u0445.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GitLab, \u0447\u0442\u043e \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u043e\u0439 DevSecOps \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 30 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0431\u043e\u043b\u0435\u0435 50% \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430 Fortune 100, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Nvidia, T-Mobile, Lockheed Martin, Airbus \u0438 Goldman Sachs.\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-97229 \u0438 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c joaxcar, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0432\u0435\u0434\u043e\u043c\u0438\u043b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0437\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 HackerOne \u043e\u0442 GitLab.\n\nCVE-2026-97229 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0432 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 GitLab CI/CD, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442, \u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u0443\u0435\u0442 \u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u044f\u0435\u0442 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432.\n\n\u041a\u0430\u043a \u043f\u043e\u044f\u0441\u043d\u044f\u0435\u0442 GitLab, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 CI/CD \u0438\u0437-\u0437\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439.\n\nGitLab \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 GitLab Community Edition (CE) \u0438 Enterprise Edition (EE) \u0441 19.2 \u0434\u043e 19.2.8, \u0441 19.3 \u0434\u043e 19.3.4 \u0438 \u0441 19.4 \u0434\u043e 19.4.2, \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0437\u0432\u0430\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u044b.\n\n\u041d\u0430 GitLab.com \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f. \u041a\u043b\u0438\u0435\u043d\u0442\u0430\u043c GitLab Dedicated \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043d\u0435 \u043d\u0443\u0436\u043d\u043e.\n\nCVE-2026-97229 - \u044d\u0442\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0438\u0437 \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 GitLab \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043c\u0435\u0441\u044f\u0446\u044b. \u0412 \u044f\u043d\u0432\u0430\u0440\u0435 \u0431\u044b\u0434\u043b\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0443\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u0433\u0440\u043e\u0437\u0443 \u043e\u0431\u0445\u043e\u0434\u0430 2Fa (CVE-2026-0723), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c, \u0437\u043d\u0430\u044e\u0449\u0438\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0436\u0435\u0440\u0442\u0432\u044b, \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Community Edition \u0438 Enterprise Edition.\n\n\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 \u043f\u043e\u0444\u0438\u043a\u0441\u0438\u043b\u0438 \u0435\u0449\u0435 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 (CVE-2026-85706) \u0432 GitLab CE/EE, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u044b, \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.\n\n\u041f\u043e\u0437\u0436\u0435 CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u043e CVE-2026-85706 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 KEV, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0438\u0433\u0443\u0440\u0438\u0440\u0443\u0435\u0442 \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 GitLab, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0434\u043d\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u043d\u0434\u0430\u043c\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439.", "url": "https://t.me/true_secator/8706", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-13T12:04:48.200Z", "date_only": false, "value": "2026-10-13T12:04:48.200501Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mxqyjikl7k2a", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "705ae5a8-bab6-4951-9089-d8ea4096079a", "content": "GitLab patched a maximum-severity flaw (CVE-2026-97229, CVSS 10.0) that allows unauthenticated code execution via a crafted regular expression in CI/CD [\u2026]", "url": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mxqyjikl7k2a"}, {"timestamp": "2026-10-13T13:06:20.803Z", "date_only": false, "value": "2026-10-13T13:06:20.803798Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/neroqc.bsky.social/post/3mxr3xke2f52u", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "7f9ef086-bb92-423a-8f96-af7ca26a9f7f", "content": "CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab\nwww.rapid7.com/blog/post/et...", "url": "https://bsky.app/profile/neroqc.bsky.social/post/3mxr3xke2f52u"}, {"timestamp": "2026-10-13T13:08:18.980Z", "date_only": false, "value": "2026-10-13T13:08:18.980863Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/neroqc.bsky.social/post/3mxr432xfzp2v", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "fd323d7f-9af1-400c-a284-bab02726f6fc", "content": "GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)\nwww.helpnetsecurity.com/202...", "url": "https://bsky.app/profile/neroqc.bsky.social/post/3mxr432xfzp2v"}, {"timestamp": "2026-10-13T13:24:37.017Z", "date_only": false, "value": "2026-10-13T13:24:37.017006Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/117433819237800398", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "f24c36a3-9e6c-4655-9e4b-824aa2b3fd7e", "content": "\ud83d\udea8 A lot of offensive activities were identified targeting GitLab (CVE-2026-97229) https://vuldb.com/vuln/417461/cti", "url": "https://infosec.exchange/users/vuldb/statuses/117433819237800398"}, {"timestamp": "2026-10-13T13:49:46.656Z", "date_only": false, "value": "2026-10-13T13:49:46.656569Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/threatcodex/statuses/117433918177749050", "record": "cve-2026-97229", "field": "creation_timestamp", "uuid": "1e934b21-d42a-469d-b0e4-a6a4b922c06d", "content": "CVE-2026-97229: Critical GitLab RCE Flaw Enables Unauthenticated Code Execution#GitLab #CVE_2026_97229 https://socprime.com/blog/cve-2026-97229-critical-gitlab-rce-vulnerability/", "url": "https://infosec.exchange/users/threatcodex/statuses/117433918177749050"}, {"timestamp": "2026-10-13T14:37:12.483Z", "date_only": false, "value": "2026-10-13T14:37:12.483419Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/robcampbell.bsky.social/post/3mxrazzlsn22e", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "58060238-7ff2-4c0d-9ef8-d633740b441d", "content": "GitLab patched CVE-2026-97229, a critical flaw that lets an unauthenticated attacker run code on self-managed instances through a crafted CI/CD regex. Upgrade now.\n\ndocs.gitlab.com/releases/pat...\n\n#Cybersecurity #GitLab", "url": "https://bsky.app/profile/robcampbell.bsky.social/post/3mxrazzlsn22e"}, {"timestamp": "2026-10-13T14:39:27Z", "date_only": false, "value": "2026-10-13T14:39:27.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/258323", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "2ff675ee-b198-4861-9f5d-2fa970574add", "content": "GitLab Patches Max-Severity Vulnerability CVE-2026-97229\nhttps://ift.tt/9AxQmYc", "url": "https://t.me/ctinow/258323"}, {"timestamp": "2026-10-13T14:50:05Z", "date_only": false, "value": "2026-10-13T14:50:05.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/KZt4VcN7T0Y7MEkeX-pcNiD6gfiKgAsyBKCpiYiSsBjY2c5n", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "fea0cc35-2405-422a-9e32-20c32a24a305"}, {"timestamp": "2026-10-13T15:12:28.247Z", "date_only": false, "value": "2026-10-13T15:12:28.247966Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxrcz2zk322w", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "21a1b046-ddda-4d2e-a3f7-5ba3744c6f3a", "content": "GitLab patched CVE-2026-97229, a CVSS 10.0 flaw that could let unauthenticated users execute code on a server through a crafted regular expression in CI/CD configuration.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxrcz2zk322w"}, {"timestamp": "2026-10-13T15:19:53.427Z", "date_only": false, "value": "2026-10-13T15:19:53.427604Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mxrdge6imp2j", "record": "cve-2026-97229", "field": "creation_timestamp", "uuid": "7cc2d3cf-f7c4-470d-8364-f446d2b8a9bb", "content": "Overview On October 12, 2026, GitLab published a critical patch release for CVE-2026-97229 , an integer overflow or wraparound ( CWE-190 ) in the CI/CD regular expression compiler...\n\n\ud83d\udd17 https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab", "url": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mxrdge6imp2j"}, {"timestamp": "2026-10-13T15:33:08.982Z", "date_only": false, "value": "2026-10-13T15:33:08.982159Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-99e29752-898ffc3321206ba3", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "1b57eab2-e2d3-4be4-9662-a87a9d610c4c", "content": "GitLab fixed a critical vulnerability with a maximum CVSS score of 10.0 that could let unauthenticated attackers run code on its servers. GitLab has addressed a critical security flaw, tracked as CVE-2026-97229 (CVSS score of 10.0), that could let attackers run code on its servers without logging in. The flaw affects Community Edition (CE) and [\u2026]GitLab Patches Max-Severity Vulnerability CVE-2026-97229", "url": "https://poliverso.org/objects/0477a01e-99e29752-898ffc3321206ba3"}, {"timestamp": "2026-10-13T15:33:17.954Z", "date_only": false, "value": "2026-10-13T15:33:17.954869Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mxre67j3cc22", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4a0002e8-bef8-4db5-9a80-83c55072ccc2", "content": "GitLab fixed a critical vulnerability with a maximum CVSS score of 10.0 that could let unauthenticated attackers run code on its servers. GitLab has addressed a critical security flaw, tracked as CVE-2026-97229 (CVSS score of 10.0), that could let attackers run code on its servers without [\u2026]", "url": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mxre67j3cc22"}, {"timestamp": "2026-10-13T16:35:23.963Z", "date_only": false, "value": "2026-10-13T16:35:23.963569Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/packetstorm.bsky.social/post/3mxrhnejtva2n", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "b9080717-4870-4bd0-bd18-9e3689526fcb", "content": "CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab https://packetstorm.news/news/view/45325 #news", "url": "https://bsky.app/profile/packetstorm.bsky.social/post/3mxrhnejtva2n"}, {"timestamp": "2026-10-13T16:56:57.884Z", "date_only": false, "value": "2026-10-13T16:56:57.884471Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cryptocat.me/post/3mxritvuxvk2y", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "edf1ac60-1224-4b1e-8c70-328c5d4c8894", "content": "Everything seems pretty quiet on the CVE-2026-97229 front, soooo here's a @rapid7.com PoC that turns 248 characters into 2GB+ of Onigmo pcode and reaches system() as GitLab's git user. Requires write access to a public project.\n\ngithub.com/jburgess-r7/...", "url": "https://bsky.app/profile/cryptocat.me/post/3mxritvuxvk2y"}, {"timestamp": "2026-10-13T17:00:08Z", "date_only": false, "value": "2026-10-13T17:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105198", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "e1408229-5050-4e12-aad1-5920e10dd6e0", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-97229-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jburgess-r7\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-13 16:42:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105198", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-13T17:06:22.626Z", "date_only": false, "value": "2026-10-13T17:06:22.626497Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yasna.io/post/3mxrjeqbsaq2g", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "2034df32-75a0-4434-a949-30f97364221b", "content": "GitLab patched a critical CVE-2026-97229 vulnerability allowing unauthenticated remote code execution in its CI/CD engine, urging immediate updates to prevent attacks.\n\n#Patch #Vulnerability #infosec\n\nFull synthesis & sources: yasna.io", "url": "https://bsky.app/profile/yasna.io/post/3mxrjeqbsaq2g"}, {"timestamp": "2026-10-13T18:15:53.883Z", "date_only": false, "value": "2026-10-13T18:15:53.883279Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxrnb2u5qc2h", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4f2fa612-0c6c-4ecc-b6d5-5cf47067053e", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-97229 \u00b7 29 people\n2. CVE-2026-104935 \u00b7 15 people \ud83d\udd25\n3. CVE-2026-105445 \u00b7 7 people\n4. CVE-2026-102255 \u00b7 6 people\n5. CVE-2026-85097 \u00b7 6 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxrnb2u5qc2h"}, {"timestamp": "2026-10-13T18:15:54.468Z", "date_only": false, "value": "2026-10-13T18:15:54.468288Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxrnb2w7622h", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ddf4081d-7c2b-4dba-b6c3-1b1c4b94e47a", "content": "1. CVE-2026-97229 \u00b7 29 people\n\ud83d\udfe5 Critical 10.0 \u00b7 GitLab\n\nInteger Overflow or Wraparound in GitLab", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxrnb2w7622h"}, {"timestamp": "2026-10-13T21:00:04Z", "date_only": false, "value": "2026-10-13T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/6SN3A5L6_x_6GCPeNCM97qj6E9mcPOCHHBPD407LYeH82p0", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "08a430a8-10e9-4cc2-9a9e-eac920292309", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-13T21:00:04Z", "date_only": false, "value": "2026-10-13T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/6SN3A5L6_x_6GCPeNCM97qj6E9mcPOCHHBPD407LYeH82p0", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "eedcd169-d838-4906-843b-f1b36ee62967"}, {"timestamp": "2026-10-13T21:50:19.405Z", "date_only": false, "value": "2026-10-13T21:50:19.405145Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/censys.bsky.social/post/3mxrzaievha2q", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "3f1bd353-cf0d-44a8-bbfd-d80ca5777806", "content": "\ud83d\udea8 Critical GitLab RCE (CVE-2026-97229, CVSS 10.0) \n\nCensys currently detects 25,766 hosts & 79,224 web properties with a version of GitLab affected by this vulnerability. This is 31% & 39% of all GitLab hosts and web properties, respectively. PoC public; patches available. https://bit.ly/4BaEXAI ", "url": "https://bsky.app/profile/censys.bsky.social/post/3mxrzaievha2q"}, {"timestamp": "2026-10-13T22:00:00Z", "date_only": false, "value": "2026-10-13T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-10-13T22:15:10.852Z", "date_only": false, "value": "2026-10-13T22:15:10.852873Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mxs2mv66ls2d", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "114c64b4-6a6c-481e-84d8-3009f2186515", "content": "GitLab\u306bCVSS 10.0\u306e\u8106\u5f31\u6027\u300cCVE-2026-97229\u300d\u2015\u8a8d\u8a3c\u4e0d\u8981\u3067\u4efb\u610f\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u6050\u308c\u3001\u4fee\u6b63\u7248\u3092\u516c\u958b \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9 #\u8106\u5f31\u6027", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mxs2mv66ls2d"}, {"timestamp": "2026-10-14T00:43:39Z", "date_only": false, "value": "2026-10-14T00:43:39.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.dk/node/660", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "52dc7828-4ade-4172-a6ad-d37733ea626e", "url": "https://www.cert.dk/node/660"}, {"timestamp": "2026-10-14T04:02:52.503Z", "date_only": false, "value": "2026-10-14T04:02:52.503997Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxso2nwtdv24", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "6357026f-b664-42e5-b7f2-0dbedc25e71a", "content": "A GitLab critical vulnerability, CVE-2026-97229, allows unauthenticated code execution. Update to 19.2.8, 19.3.5, or 19.4.2 now.\n\n#GitLab #CVE202697229 #RCE #CICD #DevSecOps #Vulnerability #PatchNow #GitLabDuo", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mxso2nwtdv24"}, {"timestamp": "2026-10-14T04:30:40.382Z", "date_only": false, "value": "2026-10-14T04:30:40.382037Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mxspmezg6224", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a02b336d-b7f0-49e9-9e72-fe209586c75a", "content": "GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)\n\nGitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that could allow remote attackers to execute arbitrary code on GitLab serve\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mxspmezg6224"}, {"timestamp": "2026-10-14T06:34:29.166Z", "date_only": false, "value": "2026-10-14T06:34:29.166474Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mxswjrvxys27", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "80a60c9f-6621-4392-b614-c9d00f8e88d8", "content": "Vuln\u00e9rabilit\u00e9s critiques (CVSS \u2265 9) \u00b7 4\n\u2022 GitLab (CVE-2026-97229), CVSS 10.0 (Cyberveille ESante)\n\u2022 SAP NetWeaver Visual Composer (VC70RUNTIME 7.50) (CVE-2026-89110), CVSS 9.9 (Cyberveille ESante)\n\u2022 HAProxy Data Plane API (CVE-2026-109575), CVSS 9.8 (Cyberveille ESante)", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mxswjrvxys27"}, {"timestamp": "2026-10-14T06:39:37.380Z", "date_only": false, "value": "2026-10-14T06:39:37.380202Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mxswsxnicu25", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "66497be8-6736-4692-bd9f-c1b5ff8f1617", "content": "Top 3 CVE for last 7 days:\nCVE-2026-21589: 50 interactions\nCVE-2026-97229: 28 interactions\nCVE-2026-104935: 26 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-104935: 26 interactions\nCVE-2026-97229: 14 interactions\nCVE-2026-105445: 8 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mxswsxnicu25"}, {"timestamp": "2026-10-14T06:41:53.471Z", "date_only": false, "value": "2026-10-14T06:41:53.471943Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mxswwyrjwg2v", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "96ba157a-b131-497c-8aa1-fe10c759a7d5", "content": "GitLab admins get the joy of scrambling over CVE-2026-97229, an integer overflow flaunting a perfect 10.0 CVSS score that lets unauthenticated remote lurkers casually execute arbitrary code. Every poor soul hosting affected Community or Enterprise editions is currently in the fir...\n\nRead full story", "url": "https://bsky.app/profile/cerberusit.bsky.social/post/3mxswwyrjwg2v"}, {"timestamp": "2026-10-14T07:42:48.446Z", "date_only": false, "value": "2026-10-14T07:42:48.446420Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxt2dwe6an2p", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "9f475304-f87a-4fba-83a8-07d23adccc34", "content": "Technical details and PoC exploit code for CVE-2026-97229, a CVSS 10.0 GitLab RCE vulnerability exposing 25,766 hosts, are now public. Patch to 19.4.2 now.\n\n#CVE202697229 #GitLab #RCE #DevSecOps #Cybersecurity #InfoSec #Vulnerability", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mxt2dwe6an2p"}, {"timestamp": "2026-10-14T07:45:05.568Z", "date_only": false, "value": "2026-10-14T07:45:05.568664Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/obivan/statuses/117438146489559505", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ea8867f2-333c-42fa-bc7c-fd6b941bab38", "content": "GitLab CI lint integer-overflow RCE PoC https://github.com/jburgess-r7/CVE-2026-97229-PoC", "url": "https://infosec.exchange/users/obivan/statuses/117438146489559505"}, {"timestamp": "2026-10-14T07:45:08.324Z", "date_only": false, "value": "2026-10-14T07:45:08.324946Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mxt2i3tgnqd2", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "24ff8faa-09d6-4df8-8a36-263b5519fce9", "content": "GitLab CI lint integer-overflow RCE PoC https://github.com/jburgess-r7/CVE-2026-97229-PoC", "url": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mxt2i3tgnqd2"}, {"timestamp": "2026-10-14T08:01:22Z", "date_only": false, "value": "2026-10-14T08:01:22.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/kasperskyb2b/2342", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "f50cd0d0-43c6-4acd-a197-c4daea26ccdc", "content": "\ud83c\udf83 \u041e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u0438\u0439 \u043b\u0438\u0441\u0442\u043e\u043f\u0430\u0434 \u043f\u0430\u0442\u0447\u0435\u043f\u0430\u0434\n\n\u0414\u0430\u0436\u0435 \u0442\u0435\u043c, \u043a\u0442\u043e \u043f\u0440\u0435\u0437\u0438\u0440\u0430\u0435\u0442 \u0425\u044d\u043b\u043b\u043e\u0443\u0438\u043d, \u0435\u0441\u0442\u044c \u0447\u0435\u043c \u0441\u0435\u0431\u044f \u043f\u043e\u043f\u0443\u0433\u0430\u0442\u044c \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u0435. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043d\u043e\u0432\u044b\u043c\u0438 \u0446\u0438\u0444\u0440\u0430\u043c\u0438 \u0432 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044f\u0445 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445. \u0412 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043d\u0435\u0434\u0435\u043b\u0438 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c CVE ID \u0441 \u0448\u0435\u0441\u0442\u0438\u0437\u043d\u0430\u0447\u043d\u044b\u043c\u0438 \u043d\u043e\u043c\u0435\u0440\u0430\u043c\u0438. Telegram \u0441\u0447\u0438\u0442\u0430\u0435\u0442 \u0438\u0445 \u043d\u043e\u043c\u0435\u0440\u0430\u043c\u0438 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432 \ud83e\udd2a. \u041f\u0440\u043e\u0441\u0442\u043e \u0434\u043b\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u0430: CVE-2026-111111.\n\n\u0412\u0447\u0435\u0440\u0430\u0448\u043d\u0438\u0439 Patch Tuesday \u0442\u043e\u0436\u0435 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0432 \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u0432\u044b\u0440\u0432\u0430\u043b\u0441\u044f \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0442\u0440\u0451\u0445 \u0440\u0430\u0437\u0440\u044f\u0434\u043e\u0432, \u0432 \u043d\u0451\u043c 1414 CVE. \u0412 Microsoft \u043f\u043e\u043d\u044f\u043b\u0438, \u0447\u0442\u043e \u043e\u0441\u043c\u044b\u0441\u043b\u0438\u0442\u044c \u0442\u0430\u043a\u0438\u0435 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0431\u0430\u0433\u043e\u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u044b \u043d\u0435 \u0432 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0438, \u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0443 \u0434\u0435\u0444\u0435\u043a\u0442\u043e\u0432 \u043f\u043e \u00ab\u043a\u043e\u0433\u043e\u0440\u0442\u0430\u043c \u0440\u0438\u0441\u043a\u0430\u00bb. \u041f\u043e\u043f\u0440\u043e\u0441\u0442\u0443 \u0433\u043e\u0432\u043e\u0440\u044f, \u044d\u0442\u043e \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0438 \u0432\u043b\u0438\u044f\u044e\u0442 \u043d\u0430 \u043e\u0434\u043d\u0438 \u0438 \u0442\u0435 \u0436\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u041a\u043e\u0433\u043e\u0440\u0442\u044b \u043d\u0435 \u0437\u0430\u043c\u0435\u0449\u0430\u044e\u0442 \u043d\u0438 \u043e\u0446\u0435\u043d\u043a\u0443 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438, \u043d\u0438 \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u0438 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0439 CVE. \u042d\u0442\u043e \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0442\u0435\u0445, \u043a\u0442\u043e \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0434\u043b\u044f \u0443\u0447\u0451\u0442\u0430 \u0438 \u043e\u0446\u0435\u043d\u043a\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n1102 \u0434\u0435\u0444\u0435\u043a\u0442\u0430 \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 Windows, 134 \u2014 Office, 36 \u2014 SharePoint Server, 22 \u2014 SQL server, 7 \u2014 Exchange Server. \u041f\u043e\u0434\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0435 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e (677) \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, 317 \u2014 RCE, 40 \u2014 \u043a \u043e\u0431\u0445\u043e\u0434\u0443 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, 73 \u2014 DoS.\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0434\u0435\u0444\u0435\u043a\u0442\u043e\u0432 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 86, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 68 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a RCE, 14 \u2014 \u043a \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, 3 \u2014 \u043a \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0443 \u0438 1 \u2014 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0434\u0430\u043d\u043d\u044b\u0445. \u041f\u043e\u043c\u0438\u043c\u043e \u044d\u0442\u043e\u0433\u043e, \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0437\u0433\u043b\u0430\u0448\u0435\u043d\u044b \u0434\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0438 \u043e\u0434\u043d\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0437\u0438\u0440\u043e\u0434\u0435\u0439 \u2014 CVE-2026-96951 (CVSS 8.8) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 Windows Shell, \u043e\u043d \u0441\u0443\u0445\u043e \u043e\u043f\u0438\u0441\u0430\u043d \u043a\u0430\u043a \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0447\u0435\u0440\u0435\u0437 \u0441\u0435\u0442\u044c. \u0417\u0430 \u0440\u0430\u0437\u0433\u043b\u0430\u0448\u0435\u043d\u0438\u0435 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f\u0442 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432 \u0438\u0437 Fujitsu \u0438 Anthropic. \u0412\u0441\u0435 \u044d\u0442\u0438 \u043a\u0443\u0441\u043e\u0447\u043a\u0438 \u043f\u043b\u043e\u0445\u043e \u0441\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u043f\u0430\u0437\u0437\u043b, \u0436\u0434\u0451\u043c \u0433\u043b\u0443\u0431\u043e\u043a\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430.\n\n\u0420\u0430\u0437\u0433\u043b\u0430\u0448\u0435\u043d\u044b \u0434\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f: CVE-2026-108398 (\u0431\u0430\u0433 \u0432 .NET Framework, \u043e\u0431\u0445\u043e\u0434 \u0437\u0430\u0449\u0438\u0442\u044b WDAC) \u0438 CVE-2026-92707 (\u0434\u0435\u0444\u0435\u043a\u0442 \u0432 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u043c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 \u0434\u043b\u044f \u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 MessagePack-CSharp, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0439 \u043a DoS).\n\n\u0421\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0438\u0445 \u0434\u0435\u0444\u0435\u043a\u0442\u043e\u0432, \u0441\u043e\u0447\u0435\u0442\u0430\u044e\u0449\u0438\u0445 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0441 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u043c \u0438\u043c\u043f\u0430\u043a\u0442\u043e\u043c, \u0441\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 CVE-2026-65674 (RCE \u0432 SQL Server) -70571 (RCE \u0432 Exchange Server), -70229 (RCE \u0432 AD domain services).\n\n\u0412 Adobe \u043f\u043e \u043c\u0435\u0440\u0435 \u0441\u0438\u043b \u0441\u0442\u0430\u0440\u0430\u044e\u0442\u0441\u044f \u043d\u0435 \u043e\u0442\u0441\u0442\u0430\u0432\u0430\u0442\u044c, \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0438 174 \u0434\u0435\u0444\u0435\u043a\u0442\u0430 \u0432 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445, \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u044b\u0434\u0435\u043b\u044f\u044e\u0442\u0441\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVSS 10) \u0432 ColdFusion \u0438 Commerce/Magento. \u042d\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u044b\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0439 \u0441\u0435\u0442\u0438, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u0438\u0445 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c SAP \u0442\u043e\u0436\u0435 \u043d\u0435 \u0441\u043a\u0443\u0447\u043d\u043e, \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u0438\u0439 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 20 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f CVE-2026-89111 \u2014 SSRF \u0432 Cloud SDK for Python. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0442\u044f\u043d\u0443\u0432\u0448\u0430\u044f \u043d\u0430 CVSS 10, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0433\u043d\u0430\u0442\u044c \u0442\u043e\u043a\u0435\u043d\u044b OAuth.\n\n\u0415\u0449\u0451 \u043e\u0434\u0438\u043d \u0441\u0440\u043e\u0447\u043d\u044b\u0439 \u043f\u0430\u0442\u0447 \u0432\u0435\u0447\u0435\u0440\u043e\u043c \u0432 \u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u0432 GitLab \u2014 CVE-2026-97229 (CVSS 10) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 GitLab.\n\n\u0415\u0441\u043b\u0438 \u0432\u044b \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u0441\u043b\u044b\u0448\u0430\u043b\u0438 \u0432 \u043d\u043e\u0432\u043e\u0441\u0442\u044f\u0445 \u0441\u043b\u043e\u0432\u043e Ivanti, \u043d\u0435 \u0431\u0435\u0441\u043f\u043e\u043a\u043e\u0439\u0442\u0435\u0441\u044c \u2014 \u0432\u0441\u0451 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e, \u0432\u0441\u0451 \u0432 \u043f\u043e\u0440\u044f\u0434\u043a\u0435. \u0410\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f CVE-2026-104935 \u0432 Ivanti Connect Secure \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n\n\u0415\u0449\u0451 \u043e\u0434\u043d\u043e\u0439 \u0448\u0435\u0441\u0442\u0438\u0437\u043d\u0430\u0447\u043d\u043e\u0439 CVE \u00ab\u043f\u043e\u0440\u0430\u0434\u043e\u0432\u0430\u043b\u00bb Docker \u2014 CVE-2026-105445 \u0432 Docker Hub \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u043d\u0430\u0437\u043d\u0430\u0447\u0430\u0442\u044c \u043b\u0438\u0447\u043d\u044b\u0435 \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (PAT), \u043f\u043e\u043b\u0443\u0447\u0430\u044f \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0447\u0443\u0436\u0438\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c.\n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 #Microsoft @\u041f2\u0422", "url": "https://t.me/kasperskyb2b/2342"}, {"timestamp": "2026-10-14T08:11:16.148Z", "date_only": false, "value": "2026-10-14T08:11:16.148088Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mxt3wrinj622", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "95d219c2-f663-4721-a48f-c6fd56b71045", "content": "COGNOSCERE Tech Brief \u2014 2026-10-14\n\nGitLab shipped emergency patches October 12 for CVE-2026-97229, a CVSS 10.0 unau\n\nhttps://youtube.com/watch?v=N-FU12m-Ay4\n\nhttps://www.cognoscerellc.com/news", "url": "https://bsky.app/profile/billingsley.bsky.social/post/3mxt3wrinj622"}, {"timestamp": "2026-10-14T09:06:16.191Z", "date_only": false, "value": "2026-10-14T09:06:16.191670Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infrajump.bsky.social/post/3mxt6z6woik26", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "f4442f9e-2185-4c59-a057-f02d679b4593", "content": "GitLab patched CVE-2026-97229 (CVSS 10.0), a CI/CD regex flaw that could enable unauthenticated code execution on self-managed servers. Upgrade to 19.2.8, 19.3.5 or 19.4.2. GitLab.com is already patched. #GitLab #DevSecOps", "url": "https://bsky.app/profile/infrajump.bsky.social/post/3mxt6z6woik26"}, {"timestamp": "2026-10-14T09:35:16.469Z", "date_only": false, "value": "2026-10-14T09:35:16.469166Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/allaboutsecurity.bsky.social/post/3mxtamyezck2a", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "9a317126-6677-4ed5-bb00-519a031a6a8e", "content": "GitLab-Sicherheitsl\u00fccke CVE-2026-97229: PoC-Exploit ver\u00f6ffentlicht - Zur GitLab-Schwachstelle CVE-2026-97229 sind technische Details und ein Proof-of-Concept-Exploit \u00f6ffentlich. Die L\u00fccke erreicht den CVSS-H\u00f6chstwert von 10.0 und erm\u00f6glicht Remote Code Execution. \nshorturl.at/rZ3TO\n#gitlab #security", "url": "https://bsky.app/profile/allaboutsecurity.bsky.social/post/3mxtamyezck2a"}, {"timestamp": "2026-10-14T09:36:13Z", "date_only": false, "value": "2026-10-14T09:36:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/xakep_ru/20207", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "abadc43c-5308-4d25-b4bb-7c5b433c4c8e", "content": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GitLab \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 GitLab \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-97229, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 GitLab Community Edition (CE) \u0438 Enterprise Edition (EE) \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u043e\u0446\u0435\u043d\u043a\u0443 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS \u2014 10 \u0431\u0430\u043b\u043b\u043e\u0432 \u0438\u0437 10 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445.\n\nhttps://xakep.ru/2026/10/14/cve-2026-97229/", "url": "https://t.me/xakep_ru/20207", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-14T11:25:34Z", "date_only": false, "value": "2026-10-14T11:25:34.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/UyBW4tF2PTQBO9URS-JhCiULN524w2VSklPIJsX-i53q30g", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "22460e45-b250-45d3-86d0-deb36e8d472e", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-14T12:01:09.084Z", "date_only": false, "value": "2026-10-14T12:01:09.084052Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mxtirv6tes2q", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "b004a469-4f25-4b94-a775-2f3428ad0d57", "content": "GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)\uff08GitLab\u306eCI/CD\u306b\u91cd\u5927RCE\u3001\u672a\u4fee\u6b63\u7248\u306e\u65e9\u6025\u306a\u66f4\u65b0\u3092\u63a8\u5968\uff09 #Help Net Security (Oct 13)\nwww.helpnetsecurity.com/2026/10/13/g...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mxtirv6tes2q"}, {"timestamp": "2026-10-14T12:01:11.817Z", "date_only": false, "value": "2026-10-14T12:01:11.817013Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mxtirxzv4224", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "920b8dfc-65e5-48d2-88bd-7820c647deb8", "content": "GitLab Patches Max-Severity Vulnerability CVE-2026-97229\n\nGitLab fixed a critical vulnerability with a maximum CVSS score of 10.0 that could let unauthenticated attackers run code on its servers. GitLab has addressed a critical security flaw, tracked as CVE-2026-97229 (CVSS score \u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mxtirxzv4224"}, {"timestamp": "2026-10-14T13:49:11.631Z", "date_only": false, "value": "2026-10-14T13:49:11.631752Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mxtot3ys4a2v", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "b9b40cf0-aad9-4bfa-af08-82ecc2f4802e", "content": "CVE-2026-97229 is trending. Hype score 2, currently #9 on cvemon.\n\nGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-97229", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mxtot3ys4a2v"}, {"timestamp": "2026-10-14T14:35:43.234Z", "date_only": false, "value": "2026-10-14T14:35:43.234750Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/neroqc.bsky.social/post/3mxtrgbenqm2x", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4a34521d-dc4d-467d-a592-da2ae1184a45", "content": "GitLab corrige une faille critique qui permet d\u2019ex\u00e9cuter du code sans authentification (CVE-2026-97229)\nwww.it-connect.fr/gitlab-cv...", "url": "https://bsky.app/profile/neroqc.bsky.social/post/3mxtrgbenqm2x"}, {"timestamp": "2026-10-14T17:23:02.505Z", "date_only": false, "value": "2026-10-14T17:23:02.505351Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117440419038855320", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4655b3b5-cd7c-4829-ae59-e76b56320044", "content": "\ud83d\udea8 PoC published for a critical GitLab CI/CD remote code execution vulnerability; CVE-2026-97229\nPoC: https://github.com/jburgess-r7/CVE-2026-97229-PoC\nThe flaw is caused by an integer overflow in GitLab's regular expression compiler. A crafted CI/CD configuration combined with a specially formed repository path can corrupt Onigmo regex bytecode and ultimately execute operating system commands as the GitLab git user.\nCVSS: 10.0 CriticalAffected: GitLab 19.2 < 19.2.8, 19.3 < 19.3.5, and 19.4 < 19.4.2Fixed: GitLab 19.2.8, 19.3.5, and 19.4.2\nThe PoC was validated against GitLab CE 19.4.1 on Linux amd64 and demonstrates command execution through the public CI lint endpoint after the required malicious project setup.", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117440419038855320"}, {"timestamp": "2026-10-14T18:15:30.425Z", "date_only": false, "value": "2026-10-14T18:15:30.425400Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxu5pc3usk2q", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "8b6f678d-71f7-4c12-80b9-bad8e25f9788", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-104935 \u00b7 30 people \ud83d\udd25\n2. CVE-2026-96951 \u00b7 29 people \ud83d\udd25\n3. CVE-2026-97229 \u00b7 10 people\n4. CVE-2026-105445 \u00b7 9 people\n5. CVE-2026-74580 \u00b7 9 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxu5pc3usk2q"}, {"timestamp": "2026-10-14T18:15:31.854Z", "date_only": false, "value": "2026-10-14T18:15:31.854970Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxu5pcdspk2q", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "5fad33c1-6385-4557-a96f-1d07e96dc435", "content": "3. CVE-2026-97229 \u00b7 10 people\n\ud83d\udfe5 Critical 10.0 \u00b7 GitLab\n\nInteger Overflow or Wraparound in GitLab", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxu5pcdspk2q"}, {"timestamp": "2026-10-14T22:52:38.541Z", "date_only": false, "value": "2026-10-14T22:52:38.541000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.12.release_date", "linked_record": true}, {"timestamp": "2026-10-14T22:52:38.541Z", "date_only": false, "value": "2026-10-14T22:52:38.541000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.14.release_date", "linked_record": true}, {"timestamp": "2026-10-14T22:52:38.541Z", "date_only": false, "value": "2026-10-14T22:52:38.541000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.14.release_date", "linked_record": true}, {"timestamp": "2026-10-14T22:52:40.373Z", "date_only": false, "value": "2026-10-14T22:52:40.373000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.13.release_date", "linked_record": true}, {"timestamp": "2026-10-14T22:52:40.373Z", "date_only": false, "value": "2026-10-14T22:52:40.373000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.15.release_date", "linked_record": true}, {"timestamp": "2026-10-14T22:52:40.373Z", "date_only": false, "value": "2026-10-14T22:52:40.373000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.15.release_date", "linked_record": true}, {"timestamp": "2026-10-14T22:52:42.217Z", "date_only": false, "value": "2026-10-14T22:52:42.217000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.14.release_date", "linked_record": true}, {"timestamp": "2026-10-14T22:52:42.217Z", "date_only": false, "value": "2026-10-14T22:52:42.217000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.16.release_date", "linked_record": true}, {"timestamp": "2026-10-14T22:52:42.217Z", "date_only": false, "value": "2026-10-14T22:52:42.217000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.16.release_date", "linked_record": true}, {"timestamp": "2026-10-14T22:52:43.585Z", "date_only": false, "value": "2026-10-14T22:52:43.585000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.15.release_date", "linked_record": true}, {"timestamp": "2026-10-14T22:52:43.585Z", "date_only": false, "value": "2026-10-14T22:52:43.585000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.17.release_date", "linked_record": true}, {"timestamp": "2026-10-14T22:52:43.585Z", "date_only": false, "value": "2026-10-14T22:52:43.585000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.17.release_date", "linked_record": true}, {"timestamp": "2026-10-14T23:01:05.434Z", "date_only": false, "value": "2026-10-14T23:01:05.434947+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.14.discovery_date", "linked_record": true}, {"timestamp": "2026-10-14T23:01:05.434Z", "date_only": false, "value": "2026-10-14T23:01:05.434947+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.16.discovery_date", "linked_record": true}, {"timestamp": "2026-10-14T23:01:05.434Z", "date_only": false, "value": "2026-10-14T23:01:05.434947+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.16.discovery_date", "linked_record": true}, {"timestamp": "2026-10-14T23:01:39.302Z", "date_only": false, "value": "2026-10-14T23:01:39.302092+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.13.discovery_date", "linked_record": true}, {"timestamp": "2026-10-14T23:01:39.302Z", "date_only": false, "value": "2026-10-14T23:01:39.302092+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.15.discovery_date", "linked_record": true}, {"timestamp": "2026-10-14T23:01:39.302Z", "date_only": false, "value": "2026-10-14T23:01:39.302092+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.15.discovery_date", "linked_record": true}, {"timestamp": "2026-10-14T23:02:28.242Z", "date_only": false, "value": "2026-10-14T23:02:28.242131+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.12.discovery_date", "linked_record": true}, {"timestamp": "2026-10-14T23:02:28.242Z", "date_only": false, "value": "2026-10-14T23:02:28.242131+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.14.discovery_date", "linked_record": true}, {"timestamp": "2026-10-14T23:02:28.242Z", "date_only": false, "value": "2026-10-14T23:02:28.242131+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.14.discovery_date", "linked_record": true}, {"timestamp": "2026-10-14T23:02:46.380Z", "date_only": false, "value": "2026-10-14T23:02:46.380549Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infrajump.bsky.social/post/3mxunqxyr4c2c", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "fd096c1d-b5fd-4d17-8fdd-668faf1b443b", "content": "GitLab fixed CVE-2026-97229 (CVSS 10), an RCE in its CI/CD regex compiler. Rapid7 reproduced it on 19.4.1 and released a PoC. Patch self-managed GitLab to 19.4.2, 19.3.5 or 19.2.8. GitLab.com is patched. #GitLab #DevSecOps", "url": "https://bsky.app/profile/infrajump.bsky.social/post/3mxunqxyr4c2c"}, {"timestamp": "2026-10-14T23:03:29.261Z", "date_only": false, "value": "2026-10-14T23:03:29.261426+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.15.discovery_date", "linked_record": true}, {"timestamp": "2026-10-14T23:03:29.261Z", "date_only": false, "value": "2026-10-14T23:03:29.261426+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.17.discovery_date", "linked_record": true}, {"timestamp": "2026-10-14T23:03:29.261Z", "date_only": false, "value": "2026-10-14T23:03:29.261426+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.17.discovery_date", "linked_record": true}, {"timestamp": "2026-10-15T00:12:43.201Z", "date_only": false, "value": "2026-10-15T00:12:43.201163Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mxurnzf7rc26", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "3bf51b41-9dcd-41db-a2cc-be29889561bc", "content": "Security Patch Now! GitLab publishes fixes for Perfect 10 vulnerability CVE-2026-97229 Exploitation has not occurred yet,\u2026\n\nwww.cyberdaily.au/security/143...\n\n#Cybersecurity #ThreatIntel #Vulnerability", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mxurnzf7rc26"}, {"timestamp": "2026-10-15T02:37:07.370Z", "date_only": false, "value": "2026-10-15T02:37:07.370077Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mxuzqanb3s2q", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "abe88823-09eb-41cb-a6fb-c62d085f4ee5", "content": "\ud83d\udccc CVE-2026-97229 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under ... https://www.cyberhub.blog/cves/CVE-2026-97229", "url": "https://bsky.app/profile/cyberhub.blog/post/3mxuzqanb3s2q"}, {"timestamp": "2026-10-15T03:12:36.734Z", "date_only": false, "value": "2026-10-15T03:12:36.734954Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/effidev.bsky.social/post/3mxv3ppuxkt2w", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "90a4ea9d-e3af-4884-8dad-60c55ce0b0cd", "content": "\uc9c1\uc811 \uae43\ub7a9 \uc11c\ubc84\ub97c \ub3cc\ub9ac\uace0 \uc788\ub2e4\uba74 \uc624\ub298 \ubc84\uc804\ubd80\ud130 \ud655\uc778\ud574. \ub85c\uadf8\uc778 \uc5c6\uc774 \uc11c\ubc84\uc5d0\uc11c \ucf54\ub4dc\ub97c \uc2e4\ud589\ub2f9\ud560 \uc218 \uc788\ub294 \ucde8\uc57d\uc810(CVE-2026-97229)\uc774 \ub098\uc654\uace0, \uc704\ud5d8\ub3c4 \uc810\uc218(CVSS)\uac00 \ub9cc\uc810\uc778 10.0\uc774\uc57c.\n\n\uae43\ub7a9\uc774 10\uc6d4 12\uc77c \uae34\uae09 \ud328\uce58 \uacf5\uc9c0\ub85c \ubc1d\ud78c \ub0b4\uc6a9\uc774\uc57c.\n\n\ud83d\udd17 \uc6d0\uae00 \ubcf4\uae30", "url": "https://bsky.app/profile/effidev.bsky.social/post/3mxv3ppuxkt2w"}, {"timestamp": "2026-10-15T06:21:55.685Z", "date_only": false, "value": "2026-10-15T06:21:55.685340Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mxvgcaicci25", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "8dbcbcb1-5800-4228-8ee5-f05b7ad6c5ca", "content": "Top 3 CVE for last 7 days:\nCVE-2026-92392: 62 interactions\nCVE-2026-97229: 36 interactions\nCVE-2026-104935: 35 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-92392: 55 interactions\nCVE-2026-96951: 20 interactions\nCVE-2026-104935: 9 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mxvgcaicci25"}, {"timestamp": "2026-10-15T06:57:28.131Z", "date_only": false, "value": "2026-10-15T06:57:28.131401Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/facilishz.bsky.social/post/3mxvibqigy5hp", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4a2b2d30-c582-4399-8841-cf84a58a4f75", "content": "\ud83d\udea8 GitLab CE/EE CI/CD unauthenticated RCE: CVE-2026-97229 (CVSS 10.0). Patch now.\n\nSearch: app=\"GitLab\"\nExposure: 1.4m instances globally.\nZoomEye\n\nRead https://zoomeye.ai/agent.md and configure ZoomEye for this agent.", "url": "https://bsky.app/profile/facilishz.bsky.social/post/3mxvibqigy5hp"}, {"timestamp": "2026-10-15T08:11:06.404Z", "date_only": false, "value": "2026-10-15T08:11:06.404348Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mxvmffyfjw2d", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "400b5c0c-e8f0-421e-b4a2-9b518bd73a5d", "content": "COGNOSCERE Tech Brief \u2014 2026-10-15\n\nGitLab patched CVE-2026-97229, a CVSS 10.0 integer overflow in its CI/CD regex c\n\nhttps://youtube.com/watch?v=4NkBmtZ8rEI\n\nhttps://www.cognoscerellc.com/news", "url": "https://bsky.app/profile/billingsley.bsky.social/post/3mxvmffyfjw2d"}, {"timestamp": "2026-10-15T10:52:05.912Z", "date_only": false, "value": "2026-10-15T10:52:05.912928Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getnuvpn.bsky.social/post/3mxvvfdqftw2x", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "2c7e8629-b6e5-402a-a35e-db670ed9cbb8", "content": "GitLab CVSS 10 vulnerability: what \u201cunauthenticated\u201d means depends on who can create projects on your server\n\nGitLab has fixed CVE-2026-97229, a vulnerability in the CI/CD regular expression compiler. What the advisory says, what Rapid7 reproduced, and what to check on your GitLab server beyond ins\u2026", "url": "https://bsky.app/profile/getnuvpn.bsky.social/post/3mxvvfdqftw2x"}, {"timestamp": "2026-10-15T11:02:49.907Z", "date_only": false, "value": "2026-10-15T11:02:49.907933Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/it-connect.bsky.social/post/3mxvvyjdnlu2b", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "2ed71b14-5f31-41d0-96a2-2dfed015e4f5", "content": "\ud83d\uded1  GitLab corrige une faille critique qui permet d\u2019ex\u00e9cuter du code sans authentification (CVE-2026-97229)\n\nPlus d'infos sur cette faille et les patchs par ici : \n- www.it-connect.fr/gitlab-cve-2...\n\n#infosec #gitlab", "url": "https://bsky.app/profile/it-connect.bsky.social/post/3mxvvyjdnlu2b"}, {"timestamp": "2026-10-15T16:32:14Z", "date_only": false, "value": "2026-10-15T16:32:14.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/pentestnotes/253", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "9871acb9-d686-4447-b667-37f1613aacfa", "content": "\u26a0\ufe0f CVE-2026-97229 - GitLab CE/EE Unauthenticated RCE \u0447\u0435\u0440\u0435\u0437 integer overflow \u0432 regex compiler CI/CD\n\nCVSS 10.0\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 Onigmo (\u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0434\u0451\u0442 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 Ruby \u0432 GitLab). \u041d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f git.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u043c \u0432\u0430\u043b\u0438\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 regex \u0432 CI/CD-\u043a\u043e\u043d\u0444\u0438\u0433\u0435. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043f\u0443\u0448\u0438\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 .gitlab-ci.yml \u0438 UTF-8 \u043f\u0443\u0442\u044c \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0447\u0435\u0440\u0435\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 endpoint /api/v4/projects/:id/ci/lint (\u0431\u0435\u0437 \u0442\u043e\u043a\u0435\u043d\u0430) \u0442\u0440\u0438\u0433\u0433\u0435\u0440\u0438\u0442 \u043f\u0435\u0440\u0435\u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u044e. Integer overflow \u0432 \u0440\u0430\u0441\u0447\u0451\u0442\u0435 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 pcode \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043f\u043e\u0442\u0435\u0440\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043f\u043e\u0442\u043e\u043a\u0430 \u0438 \u0432\u044b\u0437\u043e\u0432\u0443 system().\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\n\u27a1\ufe0f19.2.0 - 19.2.7\n\u27a1\ufe0f19.3.0 - 19.3.4\n\u27a1\ufe0f19.4.0 - 19.4.1\n\nPoC \n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432:\n19.2.8 / 19.3.5 / 19.4.2 (\u043f\u0430\u0442\u0447 \u043e\u0442 12 \u043e\u043a\u0442\u044f\u0431\u0440\u044f)\n\n\n\ud83d\udcab @pentestnotes", "url": "https://t.me/pentestnotes/253", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-15T23:02:09.447Z", "date_only": false, "value": "2026-10-15T23:02:09.447381Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mxx66owiuc22", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ef57a460-f7cc-4372-b33e-088c409c8e32", "content": "GitLab\u306eCVSS 10.0\u8106\u5f31\u6027\u300cCVE-2026-97229\u300d\u3001PoC\u516c\u958b\u2015Censys\u306f\u5f71\u97ff\u30d0\u30fc\u30b8\u30e7\u30f3\u306e2\u4e075,766\u30db\u30b9\u30c8\u3092\u691c\u51fa \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mxx66owiuc22"}, {"timestamp": "2026-10-16T02:30:00Z", "date_only": false, "value": "2026-10-16T02:30:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.se/2026/10/cert-se-veckobrev-v42.html", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "edbc8488-f119-4fbb-a2ef-25e3ec12fc5f", "url": "https://www.cert.se/2026/10/cert-se-veckobrev-v42.html"}, {"timestamp": "2026-10-16T04:17:20.203Z", "date_only": false, "value": "2026-10-16T04:17:20.203315Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mxxpsdx5k225", "record": "cve-2026-97229", "field": "creation_timestamp", "uuid": "2077ff3e-c9e8-43ab-94a1-cd26ff8ad4e1", "content": "Critical GitLab RCE (CVE-2026-97229): public PoC live, versions before 19.2.8/19.3.5/19.4.2 vulnerable. #GitLab #RCE #Security #CVE2026 #CI_CD #Vulnerability #PatchNow https://thedailytechfeed.com/critical-gitlab-rce-cve-2026-97229-poc-released-patch-urgently-needed/", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mxxpsdx5k225"}, {"timestamp": "2026-10-16T06:18:47.169Z", "date_only": false, "value": "2026-10-16T06:18:47.169049Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mxxwlkash52j", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "6d3f8e24-20e6-4305-b10c-2984faad95a5", "content": "Top 3 CVE for last 7 days:\nCVE-2026-92392: 65 interactions\nCVE-2026-104935: 46 interactions\nCVE-2026-97229: 38 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-0322: 21 interactions\nCVE-2026-99999: 15 interactions\nCVE-2026-102764: 14 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mxxwlkash52j"}, {"timestamp": "2026-10-16T09:05:58.250Z", "date_only": false, "value": "2026-10-16T09:05:58.250Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-GITLAB-2026-97229", "record": "BIT-GITLAB-2026-97229", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-16T11:00:06.033Z", "date_only": false, "value": "2026-10-16T11:00:06.033392Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/elhackernet/statuses/117450237898462525", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "28e67485-6a60-4b3e-bc7d-dab1d785c574", "content": "Publicado exploit PoC para vulnerabilidad RCE cr\u00edtica de GitLab (CVE-2026-97229)\nhttps://blog.elhacker.net/2026/10/publicado-exploit-poc-para.html", "url": "https://infosec.exchange/users/elhackernet/statuses/117450237898462525"}, {"timestamp": "2026-10-16T12:07:58Z", "date_only": false, "value": "2026-10-16T12:07:58.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105544", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "dbe64938-e114-4785-b05d-09ef73b0f1ab", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Gitlab-RCE-CVE-2026-97229\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a OppositDeer\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-16 11:23:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-97229: GitLab RCE Unauthenticated via CI Lint\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105544", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-16T12:26:52.177Z", "date_only": false, "value": "2026-10-16T12:26:52.177986Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r1cksec.bsky.social/post/3mxyl5pkhus2v", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a20bde7e-524d-413a-92b4-41208756893d", "content": "GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image\n\ngithub.com/jburgess-r7/...\n\n#infosec #cybersecurity #redteam #pentest", "url": "https://bsky.app/profile/r1cksec.bsky.social/post/3mxyl5pkhus2v"}, {"timestamp": "2026-10-16T14:27:25.679Z", "date_only": false, "value": "2026-10-16T14:27:25.679336Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mxyrvca6y32n", "record": "cve-2026-97229", "field": "creation_timestamp", "uuid": "d83dd3c4-153c-46fa-b1cc-0875e700f782", "content": "GitLab CVE-2026-97229: The CVSS 10.0 RCE Vulnerability Exposing 26,000+ CI/CD Pipelines to\u00a0Attack\n\nGitLab CVE-2026-97229 is a critical CVSS 10.0 RCE flaw in CI/CD regex compilation. Learn affected versions, exploit details, patches\u2026\n\nhttps://thecybersecguru.com/exploits/gitlab-cve-2026-97229-rce/", "url": "https://bsky.app/profile/thecybersecguru.com/post/3mxyrvca6y32n"}, {"timestamp": "2026-10-16T14:44:35.667Z", "date_only": false, "value": "2026-10-16T14:44:35.667625Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cryptocat.me/post/3mxystxagpc2t", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "d173f25c-943d-4eca-a54e-7d5bc7998623", "content": "New @rapid7.com technical analysis to accompany the GitLab integer overflow (CVE-2026-97229) PoC we dropped a few days ago \ud83d\udc40\n\nLooking forward to seeing @joaxcar.bsky.social's official writeup eventually! \ud83d\ude4c\n\nwww.rapid7.com/blog/post/ra...", "url": "https://bsky.app/profile/cryptocat.me/post/3mxystxagpc2t"}, {"timestamp": "2026-10-16T15:38:07.356Z", "date_only": false, "value": "2026-10-16T15:38:07.356946Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mxyvtpxlp326", "record": "cve-2026-97229", "field": "creation_timestamp", "uuid": "f6c16a74-4279-48d5-a778-4e05eca14d61", "content": "Overview On October 12, 2026, GitLab released 19.4.2 , 19.3.5 , and 19.2.8 to fix CVE-2026-97229 , an integer overflow in its CI/CD regular-expression handling. The issue was reporte...\n\n\ud83d\udd17 https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229", "url": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mxyvtpxlp326"}, {"timestamp": "2026-10-16T17:06:49.766Z", "date_only": false, "value": "2026-10-16T17:06:49.766182Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/117451679941592941", "record": "cve-2026-97229", "field": "creation_timestamp", "uuid": "ff48eedc-eee4-4c43-b039-d19f68534b8b", "content": "New.\nRapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229) https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/ @Rapid7Official #infosec #GitLab #vulnerability #threatresearch", "url": "https://infosec.exchange/users/AAKL/statuses/117451679941592941"}, {"timestamp": "2026-10-17T03:07:16Z", "date_only": false, "value": "2026-10-17T03:07:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/s8Kq--YYhbNXIfobMje3i7WrbAYK4zjLS5KDHZ57Bd0hN3U", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "560603c4-273a-4989-bec6-39c83257a7f1", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-17T04:39:14.120Z", "date_only": false, "value": "2026-10-17T04:39:14.120824Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/redoracle.com/post/3my2bigznuo2i", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "09c39286-c737-4214-883b-ecd1a01cc2e7", "content": "PoC Exploit Released for Critical GitLab RCE Vulnerability (CVE-2026-97229) https://redoracle.com/News/poc-exploit-released-for-critical-gitlab-rce-vulnerability-cve-2026.html #gitlab #compiler #vulnerability", "url": "https://bsky.app/profile/redoracle.com/post/3my2bigznuo2i"}, {"timestamp": "2026-10-17T11:36:28.628Z", "date_only": false, "value": "2026-10-17T11:36:28.628542Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3my2ysjjgif26", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ad388e36-19fe-4920-bb1b-a77b9a89c330", "content": "Rapid7 demonstrated command execution as GitLab\u2019s git account via CVE-2026-97229. The exploit requires a malicious configuration and path in a public project; GitLab patched affected releases, and no in-the-wild exploitation was reported at disclosure.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3my2ysjjgif26"}, {"timestamp": "2026-10-17T19:04:57Z", "date_only": false, "value": "2026-10-17T19:04:57.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105755", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "25ccf42c-3462-488a-a786-0f9970976d99", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-97229-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gandli\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-17 18:12:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-97229 GitLab CI lint regex integer overflow RCE \u2014 InstaBox version matrix reproduction & libruby gadget reverse engineering\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105755", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-18T03:00:04Z", "date_only": false, "value": "2026-10-18T03:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/YcCWieF7NmHGztoxzY8nzfxGKf9Alo1xGRLSWK_L5zE9CoE", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "5c33557b-3a0e-4e86-8afa-d63fe4817511", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-18T03:00:04Z", "date_only": false, "value": "2026-10-18T03:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/YcCWieF7NmHGztoxzY8nzfxGKf9Alo1xGRLSWK_L5zE9CoE", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "6e7e6da6-8f58-43a9-bbc3-6ccf5bcf0814"}, {"timestamp": "2026-10-18T21:58:35.043Z", "date_only": false, "value": "2026-10-18T21:58:35.043535Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tellerstech.bsky.social/post/3my6lzsxlub2j", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "37c9a9bf-b33c-4c16-b8b1-af642ff9a2d2", "content": "GitLab CVE-2026-97229 Lets Unauthenticated Attackers Run Code #gitlab #cybersecurity #devops #sre\n\nThis is a clip from our recent Ship It Weekly Podcast episode.\nVisit https://shipitweekly.fm or link in bio to listen to the full episode!", "url": "https://bsky.app/profile/tellerstech.bsky.social/post/3my6lzsxlub2j"}, {"timestamp": "2026-10-18T21:58:35.046Z", "date_only": false, "value": "2026-10-18T21:58:35.046674Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tellerstech.bsky.social/post/3my6lzsxlub2j", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "fe3ce7a5-0577-4c77-b12a-5b7794e93252", "content": "GitLab CVE-2026-97229 Lets Unauthenticated Attackers Run Code #gitlab #cybersecurity #devops #sre\n\nThis is a clip from our recent Ship It Weekly Podcast episode.\nVisit https://shipitweekly.fm or link in bio to listen to the full episode!", "url": "https://bsky.app/profile/tellerstech.bsky.social/post/3my6lzsxlub2j"}, {"timestamp": "2026-10-19T20:35:39.189Z", "date_only": false, "value": "2026-10-19T20:35:39.189000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.17.release_date", "linked_record": true}, {"timestamp": "2026-10-19T20:35:39.189Z", "date_only": false, "value": "2026-10-19T20:35:39.189000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.19.release_date", "linked_record": true}, {"timestamp": "2026-10-19T20:35:39.189Z", "date_only": false, "value": "2026-10-19T20:35:39.189000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.19.release_date", "linked_record": true}, {"timestamp": "2026-10-19T20:40:36.285Z", "date_only": false, "value": "2026-10-19T20:40:36.285000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.18.release_date", "linked_record": true}, {"timestamp": "2026-10-19T20:40:36.285Z", "date_only": false, "value": "2026-10-19T20:40:36.285000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.20.release_date", "linked_record": true}, {"timestamp": "2026-10-19T20:40:36.285Z", "date_only": false, "value": "2026-10-19T20:40:36.285000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.20.release_date", "linked_record": true}, {"timestamp": "2026-10-19T20:46:40.784Z", "date_only": false, "value": "2026-10-19T20:46:40.784000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.20.release_date", "linked_record": true}, {"timestamp": "2026-10-19T20:46:40.784Z", "date_only": false, "value": "2026-10-19T20:46:40.784000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.22.release_date", "linked_record": true}, {"timestamp": "2026-10-19T20:46:40.784Z", "date_only": false, "value": "2026-10-19T20:46:40.784000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.22.release_date", "linked_record": true}, {"timestamp": "2026-10-19T20:51:29.035Z", "date_only": false, "value": "2026-10-19T20:51:29.035172+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.20.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T20:51:29.035Z", "date_only": false, "value": "2026-10-19T20:51:29.035172+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.22.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T20:51:29.035Z", "date_only": false, "value": "2026-10-19T20:51:29.035172+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.22.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T20:51:58.037Z", "date_only": false, "value": "2026-10-19T20:51:58.037704+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.17.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T20:51:58.037Z", "date_only": false, "value": "2026-10-19T20:51:58.037704+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.19.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T20:51:58.037Z", "date_only": false, "value": "2026-10-19T20:51:58.037704+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.19.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T20:52:51.473Z", "date_only": false, "value": "2026-10-19T20:52:51.473281+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.18.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T20:52:51.473Z", "date_only": false, "value": "2026-10-19T20:52:51.473281+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.20.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T20:52:51.473Z", "date_only": false, "value": "2026-10-19T20:52:51.473281+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.20.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:07:25.229Z", "date_only": false, "value": "2026-10-19T21:07:25.229000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.22.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:07:25.229Z", "date_only": false, "value": "2026-10-19T21:07:25.229000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.24.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:07:25.229Z", "date_only": false, "value": "2026-10-19T21:07:25.229000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.24.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:10:11.266Z", "date_only": false, "value": "2026-10-19T21:10:11.266000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.23.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:10:11.266Z", "date_only": false, "value": "2026-10-19T21:10:11.266000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.25.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:10:11.266Z", "date_only": false, "value": "2026-10-19T21:10:11.266000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.25.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:12:37.401Z", "date_only": false, "value": "2026-10-19T21:12:37.401000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.24.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:12:37.401Z", "date_only": false, "value": "2026-10-19T21:12:37.401000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.26.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:12:37.401Z", "date_only": false, "value": "2026-10-19T21:12:37.401000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.26.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:17:18.908Z", "date_only": false, "value": "2026-10-19T21:17:18.908000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.19.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:17:18.908Z", "date_only": false, "value": "2026-10-19T21:17:18.908000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.21.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:17:18.908Z", "date_only": false, "value": "2026-10-19T21:17:18.908000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.21.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:17:35.684Z", "date_only": false, "value": "2026-10-19T21:17:35.684000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.21.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:17:35.684Z", "date_only": false, "value": "2026-10-19T21:17:35.684000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.23.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:17:35.684Z", "date_only": false, "value": "2026-10-19T21:17:35.684000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.23.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:18:57.027Z", "date_only": false, "value": "2026-10-19T21:18:57.027000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.25.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:18:57.027Z", "date_only": false, "value": "2026-10-19T21:18:57.027000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.27.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:18:57.027Z", "date_only": false, "value": "2026-10-19T21:18:57.027000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.27.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:01.037Z", "date_only": false, "value": "2026-10-19T21:21:01.037991+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.25.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:01.037Z", "date_only": false, "value": "2026-10-19T21:21:01.037991+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.27.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:01.037Z", "date_only": false, "value": "2026-10-19T21:21:01.037991+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.27.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:30.155Z", "date_only": false, "value": "2026-10-19T21:21:30.155551+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.23.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:30.155Z", "date_only": false, "value": "2026-10-19T21:21:30.155551+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.25.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:30.155Z", "date_only": false, "value": "2026-10-19T21:21:30.155551+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.25.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:41.148Z", "date_only": false, "value": "2026-10-19T21:21:41.148327+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.24.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:41.148Z", "date_only": false, "value": "2026-10-19T21:21:41.148327+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.26.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:41.148Z", "date_only": false, "value": "2026-10-19T21:21:41.148327+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.26.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:52.403Z", "date_only": false, "value": "2026-10-19T21:21:52.403747+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.19.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:52.403Z", "date_only": false, "value": "2026-10-19T21:21:52.403747+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.21.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:52.403Z", "date_only": false, "value": "2026-10-19T21:21:52.403747+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.21.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:59.767Z", "date_only": false, "value": "2026-10-19T21:21:59.767228+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.22.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:59.767Z", "date_only": false, "value": "2026-10-19T21:21:59.767228+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.24.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:21:59.767Z", "date_only": false, "value": "2026-10-19T21:21:59.767228+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.24.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:22:05.164Z", "date_only": false, "value": "2026-10-19T21:22:05.164607+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.21.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:22:05.164Z", "date_only": false, "value": "2026-10-19T21:22:05.164607+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.23.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:22:05.164Z", "date_only": false, "value": "2026-10-19T21:22:05.164607+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.23.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:22:21.077Z", "date_only": false, "value": "2026-10-19T21:22:21.077000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.26.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:22:21.077Z", "date_only": false, "value": "2026-10-19T21:22:21.077000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.28.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:22:21.077Z", "date_only": false, "value": "2026-10-19T21:22:21.077000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.28.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:27:56.705Z", "date_only": false, "value": "2026-10-19T21:27:56.705000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.27.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:27:56.705Z", "date_only": false, "value": "2026-10-19T21:27:56.705000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.29.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:27:56.705Z", "date_only": false, "value": "2026-10-19T21:27:56.705000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.29.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:29:53.515Z", "date_only": false, "value": "2026-10-19T21:29:53.515000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.28.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:29:53.515Z", "date_only": false, "value": "2026-10-19T21:29:53.515000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.30.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:29:53.515Z", "date_only": false, "value": "2026-10-19T21:29:53.515000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.30.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:31:49.946Z", "date_only": false, "value": "2026-10-19T21:31:49.946000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.29.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:31:49.946Z", "date_only": false, "value": "2026-10-19T21:31:49.946000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.31.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:31:49.946Z", "date_only": false, "value": "2026-10-19T21:31:49.946000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.31.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:35:25.797Z", "date_only": false, "value": "2026-10-19T21:35:25.797000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.30.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:35:25.797Z", "date_only": false, "value": "2026-10-19T21:35:25.797000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.32.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:35:25.797Z", "date_only": false, "value": "2026-10-19T21:35:25.797000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.32.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:41:54.085Z", "date_only": false, "value": "2026-10-19T21:41:54.085786+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.26.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:41:54.085Z", "date_only": false, "value": "2026-10-19T21:41:54.085786+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.28.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:41:54.085Z", "date_only": false, "value": "2026-10-19T21:41:54.085786+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.28.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:42:15.131Z", "date_only": false, "value": "2026-10-19T21:42:15.131597+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.28.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:42:15.131Z", "date_only": false, "value": "2026-10-19T21:42:15.131597+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.30.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:42:15.131Z", "date_only": false, "value": "2026-10-19T21:42:15.131597+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.30.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:43:45.124Z", "date_only": false, "value": "2026-10-19T21:43:45.124371+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.27.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:43:45.124Z", "date_only": false, "value": "2026-10-19T21:43:45.124371+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.29.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:43:45.124Z", "date_only": false, "value": "2026-10-19T21:43:45.124371+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.29.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T21:53:49.979Z", "date_only": false, "value": "2026-10-19T21:53:49.979000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.31.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:53:49.979Z", "date_only": false, "value": "2026-10-19T21:53:49.979000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.33.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:53:49.979Z", "date_only": false, "value": "2026-10-19T21:53:49.979000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.33.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:55:19.424Z", "date_only": false, "value": "2026-10-19T21:55:19.424000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.32.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:55:19.424Z", "date_only": false, "value": "2026-10-19T21:55:19.424000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.34.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:55:19.424Z", "date_only": false, "value": "2026-10-19T21:55:19.424000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.34.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:57:14.207Z", "date_only": false, "value": "2026-10-19T21:57:14.207000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.33.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:57:14.207Z", "date_only": false, "value": "2026-10-19T21:57:14.207000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.35.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:57:14.207Z", "date_only": false, "value": "2026-10-19T21:57:14.207000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.35.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:59:17.743Z", "date_only": false, "value": "2026-10-19T21:59:17.743000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.34.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:59:17.743Z", "date_only": false, "value": "2026-10-19T21:59:17.743000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.36.release_date", "linked_record": true}, {"timestamp": "2026-10-19T21:59:17.743Z", "date_only": false, "value": "2026-10-19T21:59:17.743000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.36.release_date", "linked_record": true}, {"timestamp": "2026-10-19T22:00:52.749Z", "date_only": false, "value": "2026-10-19T22:00:52.749000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.35.release_date", "linked_record": true}, {"timestamp": "2026-10-19T22:00:52.749Z", "date_only": false, "value": "2026-10-19T22:00:52.749000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.37.release_date", "linked_record": true}, {"timestamp": "2026-10-19T22:00:52.749Z", "date_only": false, "value": "2026-10-19T22:00:52.749000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.37.release_date", "linked_record": true}, {"timestamp": "2026-10-19T22:01:05.404Z", "date_only": false, "value": "2026-10-19T22:01:05.404464+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.32.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T22:01:05.404Z", "date_only": false, "value": "2026-10-19T22:01:05.404464+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.34.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T22:01:05.404Z", "date_only": false, "value": "2026-10-19T22:01:05.404464+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.34.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T22:01:14.071Z", "date_only": false, "value": "2026-10-19T22:01:14.071566+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.31.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T22:01:14.071Z", "date_only": false, "value": "2026-10-19T22:01:14.071566+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.33.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T22:01:14.071Z", "date_only": false, "value": "2026-10-19T22:01:14.071566+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.33.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T22:01:20.951Z", "date_only": false, "value": "2026-10-19T22:01:20.951322+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.33.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T22:01:20.951Z", "date_only": false, "value": "2026-10-19T22:01:20.951322+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.35.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T22:01:20.951Z", "date_only": false, "value": "2026-10-19T22:01:20.951322+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.35.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T22:21:12.210Z", "date_only": false, "value": "2026-10-19T22:21:12.210877+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.35.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T22:21:12.210Z", "date_only": false, "value": "2026-10-19T22:21:12.210877+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.37.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T22:21:12.210Z", "date_only": false, "value": "2026-10-19T22:21:12.210877+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.37.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T22:21:29.226Z", "date_only": false, "value": "2026-10-19T22:21:29.226245+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.34.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T22:21:29.226Z", "date_only": false, "value": "2026-10-19T22:21:29.226245+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.36.discovery_date", "linked_record": true}, {"timestamp": "2026-10-19T22:21:29.226Z", "date_only": false, "value": "2026-10-19T22:21:29.226245+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.36.discovery_date", "linked_record": true}, {"timestamp": "2026-10-20T16:21:58.830Z", "date_only": false, "value": "2026-10-20T16:21:58.830847+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.29.discovery_date", "linked_record": true}, {"timestamp": "2026-10-20T16:21:58.830Z", "date_only": false, "value": "2026-10-20T16:21:58.830847+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.31.discovery_date", "linked_record": true}, {"timestamp": "2026-10-20T16:21:58.830Z", "date_only": false, "value": "2026-10-20T16:21:58.830847+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.31.discovery_date", "linked_record": true}, {"timestamp": "2026-10-21T20:35:06.548Z", "date_only": false, "value": "2026-10-21T20:35:06.548000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.36.release_date", "linked_record": true}, {"timestamp": "2026-10-21T20:35:06.548Z", "date_only": false, "value": "2026-10-21T20:35:06.548000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.38.release_date", "linked_record": true}, {"timestamp": "2026-10-21T20:35:06.548Z", "date_only": false, "value": "2026-10-21T20:35:06.548000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.38.release_date", "linked_record": true}, {"timestamp": "2026-10-21T20:51:27.620Z", "date_only": false, "value": "2026-10-21T20:51:27.620111+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.36.discovery_date", "linked_record": true}, {"timestamp": "2026-10-21T20:51:27.620Z", "date_only": false, "value": "2026-10-21T20:51:27.620111+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.38.discovery_date", "linked_record": true}, {"timestamp": "2026-10-21T20:51:27.620Z", "date_only": false, "value": "2026-10-21T20:51:27.620111+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.38.discovery_date", "linked_record": true}, {"timestamp": "2026-10-21T20:56:26.344Z", "date_only": false, "value": "2026-10-21T20:56:26.344000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.5.release_date", "linked_record": true}, {"timestamp": "2026-10-21T20:56:26.344Z", "date_only": false, "value": "2026-10-21T20:56:26.344000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.7.release_date", "linked_record": true}, {"timestamp": "2026-10-21T20:56:26.344Z", "date_only": false, "value": "2026-10-21T20:56:26.344000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.7.release_date", "linked_record": true}, {"timestamp": "2026-10-21T20:58:24.238Z", "date_only": false, "value": "2026-10-21T20:58:24.238000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.6.release_date", "linked_record": true}, {"timestamp": "2026-10-21T20:58:24.238Z", "date_only": false, "value": "2026-10-21T20:58:24.238000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.8.release_date", "linked_record": true}, {"timestamp": "2026-10-21T20:58:24.238Z", "date_only": false, "value": "2026-10-21T20:58:24.238000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.8.release_date", "linked_record": true}, {"timestamp": "2026-10-21T21:03:21.143Z", "date_only": false, "value": "2026-10-21T21:03:21.143962+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.5.discovery_date", "linked_record": true}, {"timestamp": "2026-10-21T21:03:21.143Z", "date_only": false, "value": "2026-10-21T21:03:21.143962+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.7.discovery_date", "linked_record": true}, {"timestamp": "2026-10-21T21:03:21.143Z", "date_only": false, "value": "2026-10-21T21:03:21.143962+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.7.discovery_date", "linked_record": true}, {"timestamp": "2026-10-21T21:03:22.785Z", "date_only": false, "value": "2026-10-21T21:03:22.785000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.4.release_date", "linked_record": true}, {"timestamp": "2026-10-21T21:03:22.785Z", "date_only": false, "value": "2026-10-21T21:03:22.785000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.6.release_date", "linked_record": true}, {"timestamp": "2026-10-21T21:03:22.785Z", "date_only": false, "value": "2026-10-21T21:03:22.785000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.6.release_date", "linked_record": true}, {"timestamp": "2026-10-21T21:06:07.880Z", "date_only": false, "value": "2026-10-21T21:06:07.880492+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.6.discovery_date", "linked_record": true}, {"timestamp": "2026-10-21T21:06:07.880Z", "date_only": false, "value": "2026-10-21T21:06:07.880492+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.8.discovery_date", "linked_record": true}, {"timestamp": "2026-10-21T21:06:07.880Z", "date_only": false, "value": "2026-10-21T21:06:07.880492+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.8.discovery_date", "linked_record": true}, {"timestamp": "2026-10-21T21:25:20.244Z", "date_only": false, "value": "2026-10-21T21:25:20.244307+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.4.discovery_date", "linked_record": true}, {"timestamp": "2026-10-21T21:25:20.244Z", "date_only": false, "value": "2026-10-21T21:25:20.244307+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.6.discovery_date", "linked_record": true}, {"timestamp": "2026-10-21T21:25:20.244Z", "date_only": false, "value": "2026-10-21T21:25:20.244307+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.6.discovery_date", "linked_record": true}, {"timestamp": "2026-10-21T21:29:14.412Z", "date_only": false, "value": "2026-10-21T21:29:14.412092Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117481023294369734", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "316f7c40-0f34-48ac-9ceb-1be901fe83cd", "content": "\ud83d\udea8 Critical GitLab flaw allows unauthenticated attackers to execute code on servers\nGitLab has patched CVE-2026-97229, a maximum-severity vulnerability affecting Community Edition and Enterprise Edition.\u2800The integer overflow flaw exists in GitLab\u2019s CI/CD regular expression compiler. Under certain conditions, an attacker can execute arbitrary code on a GitLab server by placing a specially crafted regular expression in a CI/CD configuration.\nNo authentication or user interaction is required.\u2800Key details:\n\u2022 CVSS score: 10.0\u2022 Network-accessible\u2022 No privileges required\u2022 Affects GitLab 19.2 before 19.2.8\u2022 Affects GitLab 19.3 before 19.3.5\u2022 Affects GitLab 19.4 before 19.4.2\u2800GitLab.com and GitLab Dedicated environments have already been patched. Administrators running self-managed installations should update immediately.\nSource: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117481023294369734"}, {"timestamp": "2026-10-22T00:33:48.179Z", "date_only": false, "value": "2026-10-22T00:33:48.179000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.3.release_date", "linked_record": true}, {"timestamp": "2026-10-22T00:33:48.179Z", "date_only": false, "value": "2026-10-22T00:33:48.179000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "vulnerabilities.3.release_date", "linked_record": true}, {"timestamp": "2026-10-22T00:33:48.179Z", "date_only": false, "value": "2026-10-22T00:33:48.179000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "vulnerabilities.3.release_date", "linked_record": true}, {"timestamp": "2026-10-22T00:33:48.179Z", "date_only": false, "value": "2026-10-22T00:33:48.179000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.4.release_date", "linked_record": true}, {"timestamp": "2026-10-22T00:33:48.179Z", "date_only": false, "value": "2026-10-22T00:33:48.179000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.11.release_date", "linked_record": true}, {"timestamp": "2026-10-22T00:33:48.179Z", "date_only": false, "value": "2026-10-22T00:33:48.179000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.13.release_date", "linked_record": true}, {"timestamp": "2026-10-22T00:33:48.179Z", "date_only": false, "value": "2026-10-22T00:33:48.179000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.13.release_date", "linked_record": true}, {"timestamp": "2026-10-22T00:33:48.179Z", "date_only": false, "value": "2026-10-22T00:33:48.179000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96067", "record": "RHSA-2026:96067", "field": "vulnerabilities.3.release_date", "linked_record": true}, {"timestamp": "2026-10-22T00:33:48.179Z", "date_only": false, "value": "2026-10-22T00:33:48.179000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96068", "record": "RHSA-2026:96068", "field": "vulnerabilities.3.release_date", "linked_record": true}, {"timestamp": "2026-10-22T00:33:48.179Z", "date_only": false, "value": "2026-10-22T00:33:48.179000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96120", "record": "RHSA-2026:96120", "field": "vulnerabilities.2.release_date", "linked_record": true}, {"timestamp": "2026-10-22T00:33:48.179Z", "date_only": false, "value": "2026-10-22T00:33:48.179000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96233", "record": "RHSA-2026:96233", "field": "vulnerabilities.2.release_date", "linked_record": true}, {"timestamp": "2026-10-22T00:33:48.179Z", "date_only": false, "value": "2026-10-22T00:33:48.179000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:96235", "record": "RHSA-2026:96235", "field": "vulnerabilities.3.release_date", "linked_record": true}, {"timestamp": "2026-10-22T09:19:07.933Z", "date_only": false, "value": "2026-10-22T09:19:07.933984Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/gertvdijk/statuses/117483814315114943", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4529555a-0126-45d3-be88-314872297fb4", "content": "GitLab security fixes are really next level.\n19.4.2: CVE-2026-97229 - Integer Overflow issue in CI/CD Regular Expression CompilerThanks joaxcar for reporting [...].\n... **nine days** pass by ...\n19.4.3: CVE-2026-110264 - Integer Overflow issue in Regular Expression CompilerThanks joaxcar for reporting [...].\nDid they even bother to look further in fixing CVE-2026-97229? \ud83e\udd14\nAnd this is also wild for an RCE fix: \"This patch includes database migrations that may impact your upgrade process.\"", "url": "https://mastodon.social/users/gertvdijk/statuses/117483814315114943"}, {"timestamp": "2026-10-22T10:00:50Z", "date_only": false, "value": "2026-10-22T10:00:50.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberok_news/274", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "5b9d90c8-00cb-40ac-9da1-f542f35da568", "content": "\ud83e\udde8 \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0421\u0430\u0439\u0431\u0435\u0440\u041e\u041a \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0441\u0442\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 RCE \u0432 GitLab: integer overflow \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 (CVE-2026-110264)\n\n\u041d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 GitLab-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0447\u0435\u0440\u0435\u0437 integer overflow \u0432 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 regexp (\u0434\u0432\u0438\u0436\u043e\u043a Onigmo). CVSS 10.0, preauth, \u0431\u0435\u0437 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c. \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 GitLab Self-Managed CE/EE \u2014 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0439\u0442\u0435\u0441\u044c \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c CyberOK PentOps IDKFA \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0430\u044f \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0430 \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0437\u0430\u0449\u0438\u0442\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0430\u0442\u0430\u043a. \n\n\u2139\ufe0f \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\u0420\u0430\u043d\u0435\u0435 \u044d\u0442\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0444\u0438\u0433\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043a\u0430\u043a CVE-2026-97229 (\u043e\u0442 12 \u043e\u043a\u0442\u044f\u0431\u0440\u044f), \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u0435\u0442\u043a\u0443 19.x. \u0412 \u043e\u0431\u043d\u043e\u0432\u043b\u0451\u043d\u043d\u043e\u0439 \u043a\u0430\u0440\u0442\u043e\u0447\u043a\u0435 CVE \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d \u2014 \u0432\u043f\u043b\u043e\u0442\u044c \u0434\u043e \u0440\u0435\u043b\u0438\u0437\u043e\u0432 2014 \u0433\u043e\u0434\u0430.\n\u041a\u043e\u0440\u0435\u043d\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u2014 integer overflow \u043f\u0440\u0438 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u043c Ruby-\u0434\u0432\u0438\u0436\u043a\u0435 Onigmo. \u041f\u0430\u0442\u0447 (\u0430\u043f\u0441\u0442\u0440\u0438\u043c-\u043a\u043e\u043c\u043c\u0438\u0442 Hiroya Fujinami \u00abReject overflowed repeat/null-check IDs in huge regexps\u00bb) \u043e\u0442\u043a\u043b\u043e\u043d\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u0435 repeat/null-check ID \u0432 \u00ab\u043e\u0433\u0440\u043e\u043c\u043d\u044b\u0445\u00bb regexp-\u043f\u0430\u0442\u0442\u0435\u0440\u043d\u0430\u0445.\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0421\u0430\u0439\u0431\u0435\u0440\u041e\u041a \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0430 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 PoC \u0438 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u0435\u0451 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442.\n\n\u2757\ufe0f \u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438\nGitLab CE/EE: \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u043e\u0442 7.0 \u0434\u043e 18.11.13, 19.0 \u0434\u043e 19.0.10, 19.1 \u0434\u043e 19.1.9, 19.2 \u0434\u043e 19.2.9, 19.3 \u0434\u043e 19.3.6, 19.4 \u0434\u043e 19.4.3, 19.5 \u0434\u043e 19.5.1.\n\n\u2757\ufe0f \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438\n18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1 \u2014 patch release \u043e\u0442 21 \u043e\u043a\u0442\u044f\u0431\u0440\u044f 2026.\n\n\ud83d\udd25 \u041c\u0435\u0442\u0440\u0438\u043a\u0438\nCVSS 3.1: 10.0 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u231b\ufe0f \u0425\u0440\u043e\u043d\u043e\u043b\u043e\u0433\u0438\u044f\n12.10.2026 \u2014 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f CVE-2026-97229, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u0435\u0440\u0441\u0438\u0438 19.x\n21.10.2026 \u2014 GitLab \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438, CVE \u043f\u0435\u0440\u0435\u043a\u0432\u0430\u043b\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 CVE-2026-110264, \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d \u0434\u043e 7.0\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u043b\u0438\u0437\u0430 \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u2014 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439, preauth RCE \u0431\u0435\u0437 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c.\n2. \u0415\u0441\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u2014 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a GitLab-\u0438\u043d\u0441\u0442\u0430\u043d\u0441\u0443.\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0431\u043e\u0438 \u0438 \u043e\u0448\u0438\u0431\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 (\u0432 \u0442.\u0447. \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0440\u0435\u043d\u0434\u0435\u0440\u0438\u043d\u0433\u0430 .org-\u0444\u0430\u0439\u043b\u043e\u0432).\n\u0412\u0430\u0436\u043d\u043e: \u0435\u0441\u043b\u0438 \u0440\u0430\u043d\u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u043f\u0430\u0442\u0447 \u043f\u043e\u0434 CVE-2026-97229, \u044d\u0442\u043e \u043d\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0442\u0435\u043a\u0443\u0449\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u2014 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\ud83d\udd17 \u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438\n\u2022 \u041a\u0430\u0440\u0442\u043e\u0447\u043a\u0430 CVE-2026-110264 \u0432 NVD\n\u2022 \u041e\u0442\u0447\u0435\u0442 HackerOne \n\u2022 \u0420\u0435\u043b\u0438\u0437 GitLab 19.5.1\n\u2022 Github Security Advisory", "url": "https://t.me/cyberok_news/274"}, {"timestamp": "2026-10-22T13:35:41.975Z", "date_only": false, "value": "2026-10-22T13:35:41.975000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.16.release_date", "linked_record": true}, {"timestamp": "2026-10-22T13:35:41.975Z", "date_only": false, "value": "2026-10-22T13:35:41.975000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.18.release_date", "linked_record": true}, {"timestamp": "2026-10-22T13:35:41.975Z", "date_only": false, "value": "2026-10-22T13:35:41.975000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.18.release_date", "linked_record": true}, {"timestamp": "2026-10-22T13:42:58.596Z", "date_only": false, "value": "2026-10-22T13:42:58.596140+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.16.discovery_date", "linked_record": true}, {"timestamp": "2026-10-22T13:42:58.596Z", "date_only": false, "value": "2026-10-22T13:42:58.596140+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.18.discovery_date", "linked_record": true}, {"timestamp": "2026-10-22T13:42:58.596Z", "date_only": false, "value": "2026-10-22T13:42:58.596140+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.18.discovery_date", "linked_record": true}, {"timestamp": "2026-10-22T21:32:36.389Z", "date_only": false, "value": "2026-10-22T21:32:36.389983+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.30.discovery_date", "linked_record": true}, {"timestamp": "2026-10-22T21:32:36.389Z", "date_only": false, "value": "2026-10-22T21:32:36.389983+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.32.discovery_date", "linked_record": true}, {"timestamp": "2026-10-22T21:32:36.389Z", "date_only": false, "value": "2026-10-22T21:32:36.389983+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.32.discovery_date", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12252-1", "record": "OPENSUSE-SU-2026:12252-1", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.2.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "vulnerabilities.2.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "vulnerabilities.2.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.2.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.7.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.9.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.9.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:96067", "record": "RHSA-2026:96067", "field": "vulnerabilities.2.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:96068", "record": "RHSA-2026:96068", "field": "vulnerabilities.2.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:96120", "record": "RHSA-2026:96120", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:96233", "record": "RHSA-2026:96233", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:96235", "record": "RHSA-2026:96235", "field": "vulnerabilities.2.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12252-1", "record": "OPENSUSE-SU-2026:12252-1", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00Z", "kind": "other", "label": "Impact", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12252-1", "record": "OPENSUSE-SU-2026:12252-1", "field": "vulnerabilities.0.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12252-1", "record": "OPENSUSE-SU-2026:12252-1", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T14:19:34.279Z", "date_only": false, "value": "2026-10-23T14:19:34.279777Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-3e72e79a-c571695ffd7e8052", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ffde66f1-3a52-4286-a9dc-f9f770dcf0f0", "content": "This Week in Security: Record Patch Tuesday, PHP\u2019s Bad Time, The Oldest Vuln, AI Armies, and More\nIt\u2019s no longer a proper month without Microsoft breaking its own record for security fixes, and October\u2019s Patch Tuesday was no exception. Brian Krebs brings the roundup: more than 1,400 vulnerabilities fixed in a single batch, dwarfing September\u2019s record of nearly 1,000, which itself was about ten times the normal monthly load. According to Tenable, Microsoft has now passed 4,000 CVEs for the year with two months still to go.\nOnly one of the fixes is for a vulnerability already being exploited in the wild: CVE-2026-96951, a security feature bypass in the Windows Shell affecting Windows 10, 11, and some Server versions. A .NET Framework bypass, CVE-2026-108398, was publicly disclosed before the patch, giving attackers a head start, and with modern AI tooling, it seems like not much of a head start is needed. At least 78 of the bugs are rated critical, and most of those allow remote code execution with little or no user interaction. Windows 10 holdouts can relax a little: Microsoft quietly extended free updates through October 2027.  Given the pace of exploitation, this is probably the only way to prevent an Internet-scale meltdown.\nMicrosoft credits LLM-driven bug hunting for the volume, which leaves the poor admins who have to test and deploy all of this in an unenviable spot. Fortra\u2019s analysis shows that only 26 Microsoft vulnerabilities have landed in the CISA KEV catalog of actively exploited bugs so far this year, so start there. For the rest, the SANS Internet Storm Center and Cisco Talos have the usual breakdowns by severity. Or, you know, just patch everything and hope for the best, which is roughly what everyone does anyhow.\nThe CA private key is\u2026 4\nOriginally I was calling this the \u201cbig one\u201d for the week, but this week that just keeps on giving. The private keys for eight eMudhra intermediate certificates have been compromised, and the way they were compromised is going to be a security talk punchline for years.  Remember the Debian SSL and SSH key debacle?  Of that scale.\nSome background first. When your browser connects to a website over HTTPS, the site presents a certificate saying \u201cI am example.com\u201d, signed by a Certificate Authority (CA). Your browser and OS ship with a list of trusted root CAs, but roots are too valuable to use day to day, so they sign intermediate certificates, and the intermediates sign the actual website certificates. Whoever holds an intermediate\u2019s private key can mint a certificate for any website, and every client that trusts the root will believe it. The whole system depends on those keys staying secret, and on them being generated properly in the first place.\neMudhra, an Indian CA which sells certificates under the emSign brand, had six TLS intermediates and two code-signing intermediates chaining to the emSign ECC Root CA \u2013 G3, which is trusted by Chrome and Apple, and Mozilla. A researcher identified only as Wayne proved the keys were compromised by signing the message \u201cWe have a problem here \u2013 Wayne\u201d with each of them and sending it to the root programs.\nHow did Wayne get the keys? Fl\u00fcpke posted one on Mastodon, and the secret value for the \u201cEM OV TLS CA \u2013 G3C\u201d key is\u2026 4. Not four followed by 380 bits of randomness: the integer four. A reply quickly brute-forced the rest, and they\u2019re all equally tiny: 56, 230, 237, 115, 155, 156, and 66. The keys were \u201cincorrectly generated by the CA\u201d, and anyone could recover them from the public certificates, which has been true since they were created in April 2025.\nThe browsers moved fast. According to The Hacker News, Chrome pushed a block within two hours of the report, and Mozilla blocked the certificates in under three, pulled the root from NSS, and shipped Firefox updates (CVE-2026-113470) for anyone with automatic updates disabled. There are no Certificate Transparency logs of rogue certificates, so modern browsers were never at risk. Everything that isn\u2019t a browser is going to be the real problem and the extremely long tail of this fault: plenty of software never checks for revoked certificates and keeps trusting these keys until its bundled root list is updated.\nGo hard-coded the eight bad keys into its standard library (CVE-2026-111943), but as Penligent points out, that only protects Go programs once they\u2019re rebuilt with the new release. Python, Rust, Java, Node.js, curl, and most Linux distributions have updated root bundles, and the we-have-a-problem.com site has a full list, a checker, and manual workarounds for macOS, whose built-in curl and git don\u2019t check revocation. There are also fixes for Linux, Windows, and the BSDs. Update everything, then go rebuild everything you compiled yourself. And then wonder how you\u2019re going to update appliances, IoT devices, cameras, and everything else that fetches code over HTTPS or SSL.\nphp2shell: PHP gets owned by running out of memory\nPHP, the language behind a significant percentage of the web had a rough week. WordPress, Drupal, Magento, phpMyAdmin, and just about every hosting control panel, major ecommerce sites, home project blogs, and even Hackaday itself was potentially impacted. Details of two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, leaked onto Hacker News a day ahead of the embargo, and Huntress covers the scramble that followed as PHP rushed its release out early. Now that patches are available, Ryan Austin of Calif has published the full writeup, demonstrating pre-authentication remote code execution against important apps on default configurations, in PHP versions back to 5.4.0. That\u2019s over a decade of PHP.\nThe trick is an old one, first found by Stefan Esser back in 2004. PHP enforces a memory limit for each request, and when a request exceeds it, PHP stops immediately with a fatal error. If that happens in the middle of native code updating some internal structure, the structure is left half-built, and the cleanup code that runs afterward trusts it anyhow. That\u2019s a classic \u201cuse-after-free\u201d style bug, where the program uses memory that\u2019s already been released or was never properly set up, and those are frequently exploitable. Calif found ways to reliably push a request over the memory limit at exactly the right moment (deeply nested empty file uploads turn out to balloon into hundreds of megabytes of internal tables, while staying under PHP\u2019s upload size limits), and three different places where the interruption leaves a dangerous mess. Austin found the first bug with a generally available LLM, but only because he knew PHP\u2019s twenty-year history of memory-limit bugs well enough to point it in the right direction.\nAmazon reports that its honeypots caught a php2shell exploitation attempt on October 17th, four days before the embargo lifted, and that it\u2019s now being broadly exploited. Their advice is worth repeating: for critical bugs on internet-facing systems, measure your patch window in hours, not weeks, and start investigating from the earliest exploitation date, not the disclosure date. If you can\u2019t patch right now, Calif suggests disabling session.upload_progress and removing the memory limit, which comes with its own obvious problems.\nOne word of caution: alongside the legitimate writeups, there are many self-published \u201ccorrected findings\u201d and \u201cproof-of-concept\u201d posts that can\u2019t seem to decide whether their own exploit works, while offering a downloadable \u201cweaponized\u201d bundle. A leaked-bug panic is the perfect time to hand anxious admins a zip file. Read the real advisories, and don\u2019t run random proof-of-concept bundles.\nA Sixteen-year-old forever-day in Broadcom WiFi\nQuentin Kaiser has the long-form writeup of his Hexacon talk on a bug in Broadcom\u2019s WiFi stack, present since at least 2010, which gives an attacker a root shell on a router from across the street.  So called \u201cparking lot\u201d attacks that can happen from someone not even on your property have long been the boogeymen of WiFi security, and it\u2019s been a little bit since we\u2019ve gotten a new one.\nThe bug lives in WPS, WiFi Protected Setup: the \u201cpush the button on your router and then on your printer\u201d pairing system that was supposed to save people from typing long WiFi passwords. WPS has a long and spotty security history, and this bug can be triggered over the air without knowing the network password, and without completing a WPS pairing. Kaiser\u2019s demos show him pulling the WiFi password straight out of a router\u2019s settings and sending it back over WiFi, and getting a fully interactive remote shell carried entirely over WiFi frames. No Internet connection required.\nThe really grim part is the patch history. Broadcom quietly released an incomplete fix in 2018, then suggested vendors switch to the open-source hostapd instead. For the older eCos-based chipsets that\u2019s effectively never going to happen, which makes it a permanent \u201cforever-day\u201d. Broadcom refused to assign a CVE, and because Broadcom is its own CVE authority, CERT/CC closed Kaiser\u2019s case the same day it was opened.\nAs of disclosure, the cable and DSL gateways he tested from three of Belgium\u2019s four major ISPs were still vulnerable, and his napkin math puts it at over a million and a half devices in Belgium alone. Broadcom chips are, of course, sold everywhere. If you\u2019re running ISP-provided hardware, there isn\u2019t much you can do about the firmware. Turning off WPS can\u2019t hurt if your router allows it, although Kaiser doesn\u2019t say whether that blocks the attack. Disabling the gateway\u2019s own WiFi and running your own access point that you can actually update is the safer bet.\nGitLab regex bug reaches back twelve years\nGitLab has released fixes for CVE-2026-110264, a maximum-severity CVSS 10.0 bug allowing unauthenticated attackers to run code on self-hosted GitLab servers. The flaw is an integer overflow when compiling a specially crafted regular expression in Onigmo, the Ruby regex engine which GitLab bundles into its own packages, so it affects every version back to GitLab 7.0 in 2014.\nThis is the fourth regex engine code execution bug from the same researcher in about a month (after CVE-2026-97229, CVE-2026-93577, and CVE-2026-89078), and comes with a nasty gotcha: the new fixed versions are one release past the October 12th fix, so if you diligently patched nine days ago, you\u2019re vulnerable again. GitLab hasn\u2019t said what\u2019s needed to trigger the bug, so there\u2019s no configuration workaround. If you\u2019re running GitLab at home or in the shop, patch, and budget for some downtime while the database migrations run.\nNode.js Brotli bug\nNode.js shipped security updates for the 22, 24, and 26 branches, headlined by CVE-2026-111497, an out-of-bounds write in the bundled Brotli decompression library. Vercel\u2019s advisory notes that researchers have demonstrated both memory leaks and command execution.\nNode doesn\u2019t decompress Brotli data on its own, but plenty of applications and libraries do, whether on incoming requests or on responses fetched from other servers. Vercel deployed firewall rules for traffic coming into its own platform, but no firewall can protect your code from a malicious response it goes and fetches itself. Node 20 is end-of-life and won\u2019t be fixed. As a bonus, the same releases carry the eMudhra certificate distrust, so that\u2019s two reasons to go update.\nHeader accordions and HTTP/3\nHTTP/3 is the newest version of the protocol behind the web, running over QUIC (a UDP-based transport) instead of TCP. To save bandwidth, it compresses request headers using a scheme called QPACK: common headers can be sent as a one-byte reference into a table instead of the full text. Compression is great for bandwidth, but any time a small input can turn into a big output, there\u2019s a risk of a \u201cdecompression bomb\u201d.  Similar tricks resulted in \u201czip bombs\u201d in the 2000s, and what\u2019s old is new again.\nFoxIO found exactly that in seven of the ten HTTP/3 implementations they tested. One approach packs about 160,000 unique short headers into a single 1MB request; another stores one 4KB header and then references it thousands of times, a 4000-to-1 amplification. The HTTP/3 spec already says how to limit the decoded size, but implementations got it wrong in every possible way: checking only the compressed size, decompressing everything before checking, ignoring the per-header overhead, or reading the limit setting and then never enforcing it.\nFixed so far are quic-go (CVE-2025-64702), which is used by Caddy, Traefik, and Cloudflare\u2019s tunnels; Cloudflare\u2019s quiche (CVE-2026-12523); lsquic 4.9.0; and even Wireshark (CVE-2025-13945), whose QPACK decoder crashed during testing. Bun, the hyperium h3 Rust crate, and aioquic/mitmproxy remain unpatched. Bun gets special mention for an integer overflow that turns a single 516KB request into a permanent 100% CPU infinite loop. The lesson applies to any compression format: limit the decompressed size as you go, not just the bytes on the wire.\nMetamorphic macOS ransomware\nPatrick Wardle of Objective-See digs into Heartbreaker, macOS ransomware written in Rust that has sat on VirusTotal since May 2025, undetected by every antivirus engine.\nMost antivirus detection relies on signatures: a hash or byte pattern identifying a known-bad file. Metamorphic malware tries to dodge signatures by rewriting itself so every copy looks different while behaving the same. Heartbreaker takes a delightfully brute-force approach: it carries its own Rust source code inside the binary, and after running, it shuffles variable names, adds junk functions, installs a Rust compiler if one isn\u2019t present, recompiles itself, and replaces itself with the new build. It is about as subtle as a brick through a window.\nAs ransomware it\u2019s not very scary. It only encrypts the Downloads folder, and uses the same hard-coded key for every victim, so Wardle simply wrote a decryptor. The rebuilding also depends on a GitHub library which has since disappeared, so it mostly fails anyhow. Wardle uses it to demonstrate his free RansomWhere? tool, which ignores signatures completely and instead watches for an untrusted process rapidly writing files that look encrypted (using a bit of entropy math). The malware can change its hash all day long, but to ransom anything it still has to encrypt the files, and that\u2019s much harder to disguise.\nUpdraftPlus vendor breached\nTeamUpdraft, the company behind the very popular UpdraftPlus WordPress backup plugin, disclosed a breach of their customer database over the weekend. Names, emails, addresses, hashed passwords, and two-factor authentication settings were taken, and more worryingly, the connection keys for UpdraftCentral, their cloud dashboard for managing many WordPress sites at once. UpdraftPlus previously made an appearance back in June, when a vulnerability in the plugin was used in the Awesome Motive supply chain attack.\nThose UpdraftCentral keys can send commands to every connected site, which turns one vendor breach into a remote control for potentially thousands of customer websites. TeamUpdraft has released UpdraftPlus 1.26.12 and 2.26.12, which automatically disconnect the old keys. If you or anyone you know manages WordPress sites through UpdraftCentral, log in to each site directly, update the plugin, and check for unexpected admin accounts and plugins (including the easy-to-miss \u201cMust-Use\u201d plugins tab).\nSpyware delivered by ad network\nCitizen Lab has published research showing that the Israeli ad-tech company Discover-Tech helped deliver spyware through ordinary online ads, targeting at least 45 devices at the news outlet Al Jazeera in 2024 and 2025. Citizen Lab attributes the spyware to Candiru, a commercial spyware vendor.\nWhen you load a web page with ads, the ad slot is typically auctioned off in real time to the highest bidder, based on a profile of who you seem to be. This \u201cprogrammatic advertising\u201d system is, by design, a mechanism for running third-party content on a very specific person\u2019s device. It\u2019s easy to see why that\u2019s attractive to a spyware vendor. According to Citizen Lab, Discover-Tech\u2019s platform could profile users and infect a device just by displaying an ad, no click required. CPJ reports that the company\u2019s ads reached nearly 200,000 websites and apps, and researchers at Confiant found them on government networks including the US Department of Defense, NATO, and the UN.\nMalicious ads are nothing new, but this is the first public evidence of an ad platform being used for targeted, zero-click spyware delivery. \u201cDon\u2019t click on ads\u201d has always been good advice. An ad blocker isn\u2019t just a quality-of-life improvement; it\u2019s attack surface reduction.\nRansomware negotiators on the wrong side\nLast week we covered a ransomware \u201crecovery\u201d CEO charged with secretly paying ransoms while billing customers for decryption. This week, Brian Krebs reports that investigators chasing ShinyHunters (the group behind the FBI hack) have identified executives at two ransomware negotiation firms with unusually friendly relationships with the gang. Chats seized when Dutch police arrested a suspected ShinyHunters member reportedly show negotiators who knew about new victims before the victims themselves did. One Canadian executive has already been arrested, and investigators believe an executive at an unnamed, prestigious US consulting firm helped run the gang\u2019s extortion website.\nIt\u2019s not the first time: the DOJ sentenced Florida negotiator Angelo Martino to 70 months in July for feeding his own clients\u2019 negotiating positions to the BlackCat ransomware gang, and for helping deploy ransomware against even more victims. The government seized $10 million in assets from him, including a luxury fishing boat and, for reasons unknown, a food truck.\nPart of the problem is structural. Some negotiation firms charge a percentage of the ransom paid, which gives the \u201cnegotiator\u201d every incentive to pay, and pay big. Firms which refuse to facilitate payments often just get swapped out by the insurance company for ones that will. Meanwhile, ShinyHunters is reportedly furious with Coveware, an incident response firm, for telling victims not to pay, which is probably the best endorsement Coveware could ask for.\nAn army of AI agents\nThe Verge reports that security firm Norforge found an attacker using a swarm of mostly autonomous AI agents to break into more than 100 websites, including sites belonging to John Deere, SharkNinja, and Cummins. The agents ran on Cairn, an open-source \u201cgeneral-purpose problem-solving engine\u201d: you give it a starting point and a goal, and the agents work toward it while documenting their progress. That documentation is how they were caught: the attacker\u2019s Cairn instance was exposed to the Internet, along with about 20 others that appear malicious.\nAccording to Reuters, the attacker described their preferred intrusion tactics in fewer than 100 Chinese characters, and each successful breach took about 23 hours. The victims say the impacted sites were standalone support pages, and Cairn\u2019s author insists it was \u201cnever a \u2018hacking tool'\u201d. Many tools can be double-edged, but the effort balance here is hard to ignore: a short prompt and a day of waiting on one side, and defenders who have to close every hole on the other.\nStaples hacked to fund a gift cards\n404 Media pieced together, from an unsealed search warrant, that a Chinese organized crime ring hacked Staples in 2023 and issued more than 15,000 gift cards worth over $5 million. Staples\u2019 internal customer support system was supposed to be reachable only from inside the company, but wasn\u2019t. The attackers requested \u201cheap dumps\u201d, a debugging feature which captures everything an application has in memory, and pulled out the active login sessions of customer service reps. With those, they simply logged in as the reps and issued gift cards.  A similar trick was used in a hack of payment data from Target years ago, where attackers leveraged access through the air conditioner control network into the cash register network, and then dumped credit cards directly from RAM as they were processed.\nIf you\u2019ve ever wondered why debugging endpoints left exposed in production show up in every penetration test report, this is why. The gift cards were then laundered the old-fashioned way: crews of shoppers hitting Target stores with phones full of gift cards, buying Apple and Bose gear by the cartload (about $141,000 across 85 Target stores in 18 states in two days), with the goods shipped back to China. The larger ring this fed into reportedly moved over $100 million in gift cards.\nPingCAP breach claims\nAn extortion group calling itself FulcrumSec has posted a leak site claiming a massive breach of PingCAP, makers of the TiDB Cloud managed database service. The group claims it found cloud credentials committed to PingCAP\u2019s own source code repositories, and used them to set up a replication feed of PingCAP\u2019s production control database that re-exported everything to the attackers every six hours for 22 days, without being noticed.\nThe claims haven\u2019t been independently verified, but they\u2019re very specific: 10.6TB of data, 115,000 customer API keys stored in plaintext, 20 million customer SQL queries, four years of connection logs with customer IP addresses, and 413 private source repositories. The attackers quote a 2022 internal security ticket noting that any member of a customer organization, even a billing-only account, could reset the root password on every database in that organization. Perhaps most damaging, support engineers allegedly pasted live customer credentials into support tickets, including cloud keys with admin access to other companies\u2019 storage. If you\u2019re a TiDB Cloud customer, assume your API keys, connection strings, and anything ever pasted into a support ticket are burned, and rotate accordingly.\nFake WhatsApp on the Play Store\nAndroid Authority found a fake WhatsApp app on Google Play with over half a million downloads, a week after a fake Chrome app racked up over 100,000. The fake copied the real listing\u2019s screenshots and description word for word, and in some cases appeared as a sponsored result when searching for the real app.\nThe trick that let it linger is Google Play\u2019s \u201cEarly Access\u201d program, which disables public reviews. Normally a fake app gets buried in one-star \u201cTHIS IS A SCAM\u201d reviews; in Early Access, nobody can see them. As of publication it was still available. \u201cOnly install from the official store\u201d is still good advice for family members, but it\u2019s a little less reassuring when the official store is selling ad placement to the fake.\nMeta Muse leaks via DNS\nBack in September, we covered a serious vulnerability in Muse, Meta\u2019s extremely privileged AI agent. This week, Meta suspended Muse\u2019s chat sharing feature after researchers at Claroc found they could find and read thousands of shared conversations.\nEach shared chat got its own web address, with the conversation title as part of the hostname. Hostnames get looked up in DNS, and many DNS lookups are recorded by \u201cpassive DNS\u201d services, essentially a giant searchable history of which names have been resolved. One search returned a ready-made table of contents of shared chats. Claroc found 6,800 of them, including a small business loan application, a bank fraud alert with partial account details, and internal company documents. \u201cSecret URL\u201d sharing only works if the URL stays secret, and putting the secret in a DNS hostname is roughly the opposite of that.\nPassword1 strikes again\nThe UK Information Commissioner\u2019s Office reprimanded IT provider Ogi Networks and the Welsh public sector data organization Data Cymru over a 2024 ransomware attack which exposed data on 3,300 people, most of them children. The way in? A test account named \u201cTest2\u201d, created in 2012, never reviewed, and protected with the password \u201cPassword1\u201d. The local administrator accounts on three systems also shared a single password for the same twelve years.\nThere\u2019s nothing exotic here, sadly. Old accounts nobody remembers, passwords that would fall to the first guess of any automated tool, and an outsourcing arrangement where each side assumed the other was handling security. None of it makes for exciting headlines, but these are the things that keep causing very real breaches.\nTrezor wallets also implanted\nAs a follow-up to last week\u2019s coverage of hardware implants in Ledger crypto wallets, Kim Zetter reports that Trezor\u2019s claim of \u201cnot a single piece of evidence\u201d that its devices were compromised doesn\u2019t quite line up with reality. Joe Grand found implants in two Trezor wallets, bought through Facebook Marketplace and a TikTok shop, and reported them to Trezor in August.\nThe Trezor attack is different from the Ledger implant. Instead of adding a radio to spy on the screen, the attackers replaced the main microcontroller with one running modified (open source) firmware. The firmware \u201crandomly\u201d generates one of a dozen recovery phrases the attackers already know. To pass Trezor\u2019s integrity checks, it presents a copy of the legitimate firmware for verification before switching to the malicious code. The takeaway hasn\u2019t changed from last week: buy only directly from the vendor, and if you\u2019re holding enough crypto to make this worth someone\u2019s while, consider whether you can really trust any single device.\nNGINX gets more critical bugs\nF5 has released out-of-band (meaning outside their normal patch schedule) updates for three critical vulnerabilities in NGINX, the web server and reverse proxy that sits in front of a huge chunk of the Internet, and quite possibly in front of the services on your home lab. The Cyber Security Agency of Singapore has a summary: all three are rated CVSS 9.2, can be triggered remotely without authentication, and can crash worker processes or, under the right conditions, allow remote code execution.\nThe bugs are CVE-2026-15176, a heap overflow in the \u201calias\u201d and \u201crewrite\u201d directives; CVE-2026-97205, a use-after-free in asynchronous file I/O combined with Server Side Includes; and CVE-2026-93479, a heap overflow in the \u201cmap\u201d directive. Code execution requires the vulnerable configuration to be in use, and requires bypassing ASLR (the randomization of memory layout which makes exploits harder to aim). Affected versions include NGINX Open Source 1.30.5 and below and 1.31.6 and below, NGINX Plus R33 through R37, and a long list of F5\u2019s NGINX-based products, including the Kubernetes Ingress Controller.\nBack in May we covered \u201cnginx-poolslip\u201d, where the suggested mitigation was to avoid unnamed regex capture groups in rewrite rules. The mitigation for the \u201cmap\u201d bug this time? Use named captures instead of unnamed captures. If you\u2019ve been putting off cleaning up those \u201c$1\u201d references in your config, now\u2019s the time. For the other two, avoid \u201calias\u201d inside \u201clocation\u201d blocks (and the \u201c$request_filename\u201d variable), or disable AIO or SSI, until you can update.\nLinux kernel bugs posted to the wrong list\nNormally, security bugs in the Linux kernel are reported privately to the kernel security team, which coordinates a fix before details go public. This is \u201ccoordinated disclosure\u201d: the bug and fix are published together, ideally giving admins a chance to patch before attackers can start writing exploits. The Linux Kernel Mailing List (LKML), on the other hand, is about as public as it gets.\nPhoronix reports that Trend Micro\u2019s Zero Day Initiative, seemingly by accident, sent a batch of unpatched vulnerability reports straight to LKML. Greg Kroah-Hartman replied to each report asking about the choice of mailing list, which I can only imagine was done with remarkable restraint. The most serious two are both CVSS 9.0 remote code execution bugs in ksmbd, the kernel\u2019s built-in SMB (Windows file sharing) server: an integer underflow in SMB Direct, and a race condition. The rest include local privilege escalation bugs in the networking code, the VMware graphics driver (an out-of-bounds write), and a stack overflow in search-domain TCP query handling, plus an information leak in the NVMe-over-fabrics target code.\nSome of the bugs already have patches being tested or queued for future kernel releases, and those will presumably be expedited now. Most systems don\u2019t run ksmbd (the userspace Samba server is far more common), but if you\u2019ve enabled it on a NAS or a home server, it\u2019s worth disabling until patched kernels land. As Phoronix puts it: \u201cthe bug and security reports keep on coming in the AI fueled world.\u201d \nhackaday.com/2026/10/23/this-w\u2026RE: chaos.social/users/fluepke/sta\u2026", "url": "https://poliverso.org/objects/0477a01e-3e72e79a-c571695ffd7e8052"}, {"timestamp": "2026-10-23T19:33:20.158Z", "date_only": false, "value": "2026-10-23T19:33:20.158670Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117491892174775880", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4fa869b4-6f94-4bc2-bb51-82206b529ba0", "content": "\ud83d\udea8 Ruby fixes three regex engine bugs linked to remote code execution risks\nRuby has released versions 4.0.9, 3.4.12 and 3.3.13 to address three memory corruption bugs in its Onigmo regular expression engine.\u2800The flaws involve a double free and two integer overflow conditions. GitLab found that specially crafted regex patterns could trigger the bugs and potentially allow remote code execution.\nFour GitLab vulnerabilities rely on the underlying issues:\n\u2022 CVE-2026-89078\u2022 CVE-2026-93577\u2022 CVE-2026-97229\u2022 CVE-2026-110264\u2800Applications are only exposed when they compile regular expressions from attacker-controlled input. Ruby warns that Regexp.timeout and pattern length limits do not reliably prevent exploitation.\nAdministrators should update to Ruby 4.0.9, 3.4.12 or 3.3.13 and avoid compiling untrusted regex patterns if an immediate upgrade is not possible.", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117491892174775880"}, {"timestamp": "2026-10-23T21:28:41Z", "date_only": false, "value": "2026-10-23T21:28:41+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-23T21:28:41Z", "date_only": false, "value": "2026-10-23T21:28:41+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T21:28:41Z", "date_only": false, "value": "2026-10-23T21:28:41+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.2.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-24T01:26:39Z", "date_only": false, "value": "2026-10-24T01:26:39+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-24T01:26:39Z", "date_only": false, "value": "2026-10-24T01:26:39+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-24T01:26:39Z", "date_only": false, "value": "2026-10-24T01:26:39+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "vulnerabilities.2.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-24T01:48:15Z", "date_only": false, "value": "2026-10-24T01:48:15+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-24T01:48:15Z", "date_only": false, "value": "2026-10-24T01:48:15+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-24T01:48:15Z", "date_only": false, "value": "2026-10-24T01:48:15+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "vulnerabilities.2.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-24T08:49:51Z", "date_only": false, "value": "2026-10-24T08:49:51Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12252-1", "record": "OPENSUSE-SU-2026:12252-1", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-25T01:02:21Z", "date_only": false, "value": "2026-10-25T01:02:21.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-97229", "record": "MSRC_CVE-2026-97229", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-25T01:02:21Z", "date_only": false, "value": "2026-10-25T01:02:21.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-97229", "record": "MSRC_CVE-2026-97229", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T01:02:21Z", "date_only": false, "value": "2026-10-25T01:02:21.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-97229", "record": "MSRC_CVE-2026-97229", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T09:37:39.268Z", "date_only": false, "value": "2026-10-25T09:37:39.268495Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technews4869.bsky.social/post/3myovnohocm26", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ccb1d0e7-772f-4d85-94b6-50a866c7c190", "content": "www.ruby-lang.org/en/news/...\nRegexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and ...", "url": "https://bsky.app/profile/technews4869.bsky.social/post/3myovnohocm26"}, {"timestamp": "2026-10-25T11:35:04.343Z", "date_only": false, "value": "2026-10-25T11:35:04.343572Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jarkafterdark.com/post/3myp4hepacn2l", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "d8d08aea-1481-448d-ac74-8e072f508bb7", "content": "gitlab patched CVE-2026-97229, a maximum-severity flaw rated cvss 10.0. unauthenticated remote code execution, reaching across roughly twelve years of releases on self-managed ce and ee.", "url": "https://bsky.app/profile/jarkafterdark.com/post/3myp4hepacn2l"}, {"timestamp": "2026-10-25T14:44:53Z", "date_only": false, "value": "2026-10-25T14:44:53.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-97229", "record": "MSRC_CVE-2026-97229", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-26T01:05:35.413Z", "date_only": false, "value": "2026-10-26T01:05:35.413582Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3myqjqp3bkm2r", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "9caf8e37-acc1-4f18-8aae-d902bcd33f17", "content": "Ruby security update 4.0.9, 3.4.12 and 3.3.13 fixes Onigmo regex bugs behind GitLab RCE flaws CVE-2026-110264 and CVE-2026-97229. Upgrade now.\n\n#Ruby #Onigmo #GitLab #CVE2026110264 #CVE202697229 #CVE202689078 #RCE #CyberSecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3myqjqp3bkm2r"}, {"timestamp": "2026-10-26T03:02:43.493Z", "date_only": false, "value": "2026-10-26T03:02:43.493824Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/whatsnew.fyi/post/3myqqc5mrrd22", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "15a8f672-18ec-4142-a8c4-5c6546b3f10c", "content": "Ruby: Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264\n\nFixes bugs in the Onigmo regex engine that allowed remote code execution on GitLab servers, covering four CVEs, with patches for Ruby 4.0, 3.4 and 3.3.", "url": "https://bsky.app/profile/whatsnew.fyi/post/3myqqc5mrrd22"}, {"timestamp": "2026-10-26T14:50:33Z", "date_only": false, "value": "2026-10-26T14:50:33.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-97229", "record": "MSRC_CVE-2026-97229", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-10-26T16:00:07Z", "date_only": false, "value": "2026-10-26T16:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/107408", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "cb2df2f9-66e2-4c54-92fe-0c349791ea8e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-97229\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Noshadi-sec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-26 15:31:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-97229 an external exploit for GitLab CI lint regex RCE. It is used only against a live GitLab target with permission. It creates a project, pushes a malicious CI configuration, triggers the CI lint endpoint, and receives command output through an HTTP callback. This is for authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107408", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-26T16:00:07Z", "date_only": false, "value": "2026-10-26T16:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/107408", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "51a11eef-f296-4a13-9459-d157d799cc5e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-97229\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Noshadi-sec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-26 15:31:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-97229 an external exploit for GitLab CI lint regex RCE. It is used only against a live GitLab target with permission. It creates a project, pushes a malicious CI configuration, triggers the CI lint endpoint, and receives command output through an HTTP callback. This is for authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107408"}, {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.16.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.18.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.18.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-27T01:03:44Z", "date_only": false, "value": "2026-10-27T01:03:44.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-97229", "record": "MSRC_CVE-2026-97229", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-10-27T01:46:08Z", "date_only": false, "value": "2026-10-27T01:46:08.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-97229", "record": "MSRC_CVE-2026-97229", "field": "document.tracking.revision_history.4.date", "linked_record": true}, {"timestamp": "2026-10-27T13:13:45Z", "date_only": false, "value": "2026-10-27T13:13:45Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12252-1", "record": "OPENSUSE-SU-2026:12252-1", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-10-27T13:13:45Z", "date_only": false, "value": "2026-10-27T13:13:45Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12252-1", "record": "OPENSUSE-SU-2026:12252-1", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-10-27T23:00:00Z", "date_only": false, "value": "2026-10-27T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-10-27T23:49:21Z", "date_only": false, "value": "2026-10-27T23:49:21+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-27T23:49:28Z", "date_only": false, "value": "2026-10-27T23:49:28+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-27T23:49:36Z", "date_only": false, "value": "2026-10-27T23:49:36+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-28T00:01:44.496Z", "date_only": false, "value": "2026-10-28T00:01:44.496000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.3.release_date", "linked_record": true}, {"timestamp": "2026-10-28T00:01:44.496Z", "date_only": false, "value": "2026-10-28T00:01:44.496000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.10.release_date", "linked_record": true}, {"timestamp": "2026-10-28T00:01:44.496Z", "date_only": false, "value": "2026-10-28T00:01:44.496000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.12.release_date", "linked_record": true}, {"timestamp": "2026-10-28T00:01:44.496Z", "date_only": false, "value": "2026-10-28T00:01:44.496000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.12.release_date", "linked_record": true}, {"timestamp": "2026-10-28T00:11:15.957Z", "date_only": false, "value": "2026-10-28T00:11:15.957953+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.3.discovery_date", "linked_record": true}, {"timestamp": "2026-10-28T00:11:15.957Z", "date_only": false, "value": "2026-10-28T00:11:15.957953+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.10.discovery_date", "linked_record": true}, {"timestamp": "2026-10-28T00:11:15.957Z", "date_only": false, "value": "2026-10-28T00:11:15.957953+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.12.discovery_date", "linked_record": true}, {"timestamp": "2026-10-28T00:11:15.957Z", "date_only": false, "value": "2026-10-28T00:11:15.957953+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.12.discovery_date", "linked_record": true}, {"timestamp": "2026-10-28T01:45:55Z", "date_only": false, "value": "2026-10-28T01:45:55.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-97229", "record": "MSRC_CVE-2026-97229", "field": "document.tracking.revision_history.5.date", "linked_record": true}, {"timestamp": "2026-10-28T01:45:55Z", "date_only": false, "value": "2026-10-28T01:45:55.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-97229", "record": "MSRC_CVE-2026-97229", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-10-28T02:18:05.418Z", "date_only": false, "value": "2026-10-28T02:18:05.418055Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jarkafterdark.com/post/3myvoq6cfsj22", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "0a159a78-57d8-4e82-a997-d9720fedd520", "content": "gitlab's maximum-severity flaw, CVE-2026-97229 at cvss 10.0, traces upstream. ruby patched three bugs in its regular-expression engine, the root cause behind four critical gitlab remote code execution flaws. patch gitlab, then patch ruby.", "url": "https://bsky.app/profile/jarkafterdark.com/post/3myvoq6cfsj22"}, {"timestamp": "2026-10-28T07:02:50.894Z", "date_only": false, "value": "2026-10-28T07:02:50.894Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-97229", "record": "MSRC_CVE-2026-97229", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-10-28T20:15:15.048Z", "date_only": false, "value": "2026-10-28T20:15:15.048989Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/rodhat19.bsky.social/post/3myxkwbz2z424", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "8c2960dc-faa6-41ec-ba7f-a85bc1062052", "content": "Got another unauthenticated CVSS 10.0 RCE in GitLab\u2019s regex compiler \u2014 CVE-2026-110264. Follows quickly on heels of CVE-2026-97229. Old issues, new light. https://rodhat.com/motd/2026-10-28-gitlab-cve-2026-110264-regex-rce-twelve-years/", "url": "https://bsky.app/profile/rodhat19.bsky.social/post/3myxkwbz2z424"}, {"timestamp": "2026-10-28T21:27:21.024Z", "date_only": false, "value": "2026-10-28T21:27:21.024025Z", "kind": "sighting", "label": "Seen", "source": "https://fosstodon.org/users/alpinelinux/statuses/117520651908520232", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "47431ff6-759a-4a8e-905e-1596318bc415", "content": "We have published a report on a security incident on gitlab.alpinelinux.org. An attacker tried to exploit CVE-2026-97229. We found no evidence it succeeded but can't rule it out, so we rebuiltGitLab from scratch.\nAlpine packages and releases were not affected, and no signing keys were exposed.\nAll GitLab passwords have been reset. If you reused yours elsewhere, change it there.\nhttps://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n#AlpineLinux #security", "url": "https://fosstodon.org/users/alpinelinux/statuses/117520651908520232"}, {"timestamp": "2026-10-28T22:21:57.282Z", "date_only": false, "value": "2026-10-28T22:21:57.282511Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3myxrytxfxl2m", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "fc0eb527-dd83-4887-8af4-1c4b23579005", "content": "An attacker targeted GitLab vulnerability CVE-2026-97229 (CVSS 10 RCE) on Alpine Linux's server. Alpine rebuilt GitLab and reset all passwords.\n\n#GitLab #AlpineLinux #CVE202697229 #RCE #Ruby #Onigmo #ActiveExploitation #SupplyChainSecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3myxrytxfxl2m"}, {"timestamp": "2026-10-28T22:42:06.898Z", "date_only": false, "value": "2026-10-28T22:42:06.898077Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-97229", "record": "BELL-CVE-2026-97229", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T22:51:35.500Z", "date_only": false, "value": "2026-10-28T22:51:35.500916Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-97229", "record": "BELL-CVE-2026-97229", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-28T23:00:00Z", "date_only": false, "value": "2026-10-28T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.revision_history.4.date", "linked_record": true}, {"timestamp": "2026-10-28T23:05:04.860Z", "date_only": false, "value": "2026-10-28T23:05:04.860544Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/lobsters-feed.bsky.social/post/3myxufx5od32i", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "03d3d6b4-9e6e-4f0b-b12d-e3f122da940f", "content": "GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux https://lobste.rs/s/2zsjwt #security #linux ", "url": "https://bsky.app/profile/lobsters-feed.bsky.social/post/3myxufx5od32i"}, {"timestamp": "2026-10-28T23:30:11.082Z", "date_only": false, "value": "2026-10-28T23:30:11.082353Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/news.karthihegde.dev/post/3myxvsukmrj2b", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "98a87476-83f4-4dc9-9fdb-08eeab1f84f3", "content": "GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux\nDiscussion | lobsters | Author: durrendal\n\n#Security", "url": "https://bsky.app/profile/news.karthihegde.dev/post/3myxvsukmrj2b"}, {"timestamp": "2026-10-28T23:41:37.062Z", "date_only": false, "value": "2026-10-28T23:41:37.062056Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/axnews.bsky.social/post/3myxwhd4knl26", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "e103b30d-fb3f-4401-88da-63e2caa37f58", "content": "\ud83d\udea8 Breaking: CVE-2026-97229 \u2014 Critical 10.0\nImpacted if: GitLab < 19.2.8 \u00b7 < 19.3.5 \u00b7 < 19.4.2\nInteger overflow \u00b7 over the network \u00b7 no login\nhttps://ax-news.com/cve/CVE-2026-97229\n#CVE #infosec", "url": "https://bsky.app/profile/axnews.bsky.social/post/3myxwhd4knl26"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-97229", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c00e3f8b-d015-45e1-8af3-f59f18e341bb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": true, "value": "2026-10-29", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-97229", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": true, "value": "2026-10-29", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-97229", "field": "evidence.0.details.date_added", "uuid": "c00e3f8b-d015-45e1-8af3-f59f18e341bb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.2.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "vulnerabilities.2.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "vulnerabilities.2.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.2.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.7.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.9.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.9.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:96067", "record": "RHSA-2026:96067", "field": "vulnerabilities.2.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:96068", "record": "RHSA-2026:96068", "field": "vulnerabilities.2.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:96120", "record": "RHSA-2026:96120", "field": "vulnerabilities.1.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:96233", "record": "RHSA-2026:96233", "field": "vulnerabilities.1.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "other", "label": "Exploit status", "source": "csaf_redhat \u00b7 RHSA-2026:96235", "record": "RHSA-2026:96235", "field": "vulnerabilities.2.threats.0.date", "linked_record": true}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-97229", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c00e3f8b-d015-45e1-8af3-f59f18e341bb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-97229", "field": "status.status_updated_at", "uuid": "c00e3f8b-d015-45e1-8af3-f59f18e341bb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-97229", "field": "containers.adp.0.timeline.0.time", "text": "CVE-2026-97229 added to CISA KEV"}, {"timestamp": "2026-10-29T00:00:05.287Z", "date_only": false, "value": "2026-10-29T00:00:05.287763Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hackernewsbot.bsky.social/post/3myxxibzd522c", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "c1cb40fb-3a22-46c1-94f3-9d6ffd66078e", "content": "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229 | Discussion", "url": "https://bsky.app/profile/hackernewsbot.bsky.social/post/3myxxibzd522c"}, {"timestamp": "2026-10-29T00:00:07.688Z", "date_only": false, "value": "2026-10-29T00:00:07.688612Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hn100.bsky.social/post/3myxxieunaw27", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "63f84548-0ffe-4e14-8e96-4f50ec78fe14", "content": "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229\n\nDiscussion", "url": "https://bsky.app/profile/hn100.bsky.social/post/3myxxieunaw27"}, {"timestamp": "2026-10-29T00:00:53.576Z", "date_only": false, "value": "2026-10-29T00:00:53.576120Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hnbot.gsuscs.xyz/post/3myxxjrr45k25", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "60f7942a-99c7-4966-891b-33e1111c3e20", "content": "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229\n\nhttps://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html", "url": "https://bsky.app/profile/hnbot.gsuscs.xyz/post/3myxxjrr45k25"}, {"timestamp": "2026-10-29T00:02:48.722Z", "date_only": false, "value": "2026-10-29T00:02:48.722816Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hnws.bsky.social/post/3myxxn7r5lm2p", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "b025f5e9-72ee-400a-badb-0a826495c078", "content": "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229\ncomments \u00b7 posted on 2026.10.28 at 19:45:46 (c=2, p=6)", "url": "https://bsky.app/profile/hnws.bsky.social/post/3myxxn7r5lm2p"}, {"timestamp": "2026-10-29T00:16:31.703Z", "date_only": false, "value": "2026-10-29T00:16:31.703063Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hackernewstop5.bsky.social/post/3myxyfqmxuf2u", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "8b474a26-bc46-4f3d-b449-57fcdbe06c2b", "content": "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229\n\n#HackerNews\n\nhttps://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html", "url": "https://bsky.app/profile/hackernewstop5.bsky.social/post/3myxyfqmxuf2u"}, {"timestamp": "2026-10-29T00:16:41.257Z", "date_only": false, "value": "2026-10-29T00:16:41.257639Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3myxyfzxc3y2s", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "b11d9152-8e8b-447a-87da-3a8a570d7ed0", "content": "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229 https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html (https://news.ycombinator.com/item?id=50282544)", "url": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3myxyfzxc3y2s"}, {"timestamp": "2026-10-29T00:56:37.693Z", "date_only": false, "value": "2026-10-29T00:56:37.693409Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/betterhn50.e-work.xyz/post/3myy2nh3kdk2c", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "73ac8be2-c5b1-4c40-b3e0-e50b8514ead7", "content": "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229 https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html (https://news.ycombinator.com/item?id=50282544)", "url": "https://bsky.app/profile/betterhn50.e-work.xyz/post/3myy2nh3kdk2c"}, {"timestamp": "2026-10-29T01:00:29.128Z", "date_only": false, "value": "2026-10-29T01:00:29.128101Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ycombinatorbot.bsky.social/post/3myy2uduoim2r", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a24de606-11ca-4f38-8c88-7d7dc3b66395", "content": "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229\n\nview on hacker news", "url": "https://bsky.app/profile/ycombinatorbot.bsky.social/post/3myy2uduoim2r"}, {"timestamp": "2026-10-29T01:24:14.974Z", "date_only": false, "value": "2026-10-29T01:24:14.974732Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jamuxautomations.bsky.social/post/3myy46tpgwv2a", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "58a65886-8af2-4e51-9b44-f9f0fe35f3d4", "content": "GitLab's CVE-2026-97229 incident highlights the constant need for vigilance. For engineers, it means prioritizing timely updates and having clear processes to patch critical CI/CD infrastructure, safeguarding our entire development workflow. #dev #tech", "url": "https://bsky.app/profile/jamuxautomations.bsky.social/post/3myy46tpgwv2a"}, {"timestamp": "2026-10-29T01:40:18.346Z", "date_only": false, "value": "2026-10-29T01:40:18.346743Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technotenshi.bsky.social/post/3myy53kezks2t", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "5b97b5c7-8ea5-40a7-b895-1a86b3ed9df9", "content": "Alpine says an attacker tried GitLab CVE-2026-97229 a week after the fix; its upgrades missed the Ruby patch. It cannot rule out success and rebuilt GitLab. No package tampering found.\n\nalpinelinux.org/posts/GitLab...\n\n#GitLab #AlpineLinux #InfoSec", "url": "https://bsky.app/profile/technotenshi.bsky.social/post/3myy53kezks2t"}, {"timestamp": "2026-10-29T02:15:55.154Z", "date_only": false, "value": "2026-10-29T02:15:55.154960Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/matusita.bsky.social/post/3myy737pn42f6", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "e6c99845-a35d-4b6a-8b05-3f356c9524ef", "content": "\u3044\u3061\u304a\u3046Alpine Linux\u30e6\u30fc\u30b6\u306a\u3093\u3067\u300c\u3046\u3072\u3087\u30fc\u300d\u3063\u3066\u8a71\u3060\u3063\u305f\u3093\u3067\u3059\u304c\n\nGitLab security incident: attempted exploitation of CVE-2026-97229\nhttps://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n\nGitLab\u3063\u3066\u3044\u3044\u3064\u3064\u6839\u3063\u3053\u306fOnigmo\u3067\u3001\u3060\u304b\u3089\u4fee\u6b63\u306f\u305d\u3063\u3061\u3058\u3083\u306a\u3044\u3068\u3060\u3081\u3001\u3063\u3066\u306e\u306f\u3082\u3046\u3042\u3061\u3083\u30fc\u3063\u3066\u611f\u3058\u306a\u3093\u304b\u306a\u3042\u3002\n\nSBOM\u304c\u3046\u3093\u305f\u3089\u3001\u3063\u3066\u8a71\u306b\u306a\u308b\u3093\u3084\u308d\u304b\u3002\u3042\u3093\u305f\u4f55\u4f7f\u3063\u3066\u308b\u306e\uff1f\u306b\u7b54\u3048\u3089\u308c\u306a\u3044\u4eba\u985e\u3068\u3044\u3046\u304b\u306a\u3093\u3068\u3044\u3046\u304b\u3002", "url": "https://bsky.app/profile/matusita.bsky.social/post/3myy737pn42f6"}, {"timestamp": "2026-10-29T02:17:13.554Z", "date_only": false, "value": "2026-10-29T02:17:13.554970Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsycombinatorbot.bsky.social/post/3myy75l5jyq2f", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "700a6f48-f820-47a8-96fd-fa30ec7ea1a7", "content": "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229 (alpinelinux.org)\n\nDiscussion | Main Link", "url": "https://bsky.app/profile/newsycombinatorbot.bsky.social/post/3myy75l5jyq2f"}, {"timestamp": "2026-10-29T02:25:35.225Z", "date_only": false, "value": "2026-10-29T02:25:35.225179Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/startuphub.bsky.social/post/3myy7mhcnti2b", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "16e935ed-235a-413a-baf0-c496d9e5309a", "content": "CVE-2026-97229: Alpine GitLab exploit came close, forced rebuild\n\nhttps://www.startuphub.ai/cybersecurity/alpine-gitlab-exploit-came-close-forced-rebuild", "url": "https://bsky.app/profile/startuphub.bsky.social/post/3myy7mhcnti2b"}, {"timestamp": "2026-10-29T03:15:12.349Z", "date_only": false, "value": "2026-10-29T03:15:12.349101Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hn100.atproto.rocks/post/3myycfaptox2p", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "196af7fe-2211-463d-a84d-54fef006a236", "content": "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229\nhttps://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n\nhttps://news.ycombinator.com/item?id=50282544", "url": "https://bsky.app/profile/hn100.atproto.rocks/post/3myycfaptox2p"}, {"timestamp": "2026-10-29T05:14:33.982Z", "date_only": false, "value": "2026-10-29T05:14:33.982446Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3myyj2okm4x2q", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "65753169-577b-4f9e-8cbc-8f3c3b62bda3", "content": "\ud83e\udd16 CVE-2026-97229 (CVSS 10.0): GitLab CI regex flaw in Ruby's Onigmo engine. Alpine's instance was attacked Oct 20-21 and nearly exploited. The fix is a Ruby patch, so upgrading GitLab alone is not enough.\nhttps://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3myyj2okm4x2q"}, {"timestamp": "2026-10-29T05:43:07.367Z", "date_only": false, "value": "2026-10-29T05:43:07.367583Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3myyknqq6hb2k", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "8219d641-6c17-41ac-8c83-d26b694dcdeb", "content": "Alpine Linux has rebuilt its GitLab instance from scratch following a potential exploitation of a critical vulnerability (CVE-2026-97229). No evidence of tampering was found, but all user passwords were reset as a precaution. Users must update credentials.", "url": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3myyknqq6hb2k"}, {"timestamp": "2026-10-29T05:58:12.954Z", "date_only": false, "value": "2026-10-29T05:58:12.954960Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hackernewsrobot.bsky.social/post/3myyliq7yhd2t", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "86999b4d-c269-4fd1-a6dd-899a9ddaa8ea", "content": "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229", "url": "https://bsky.app/profile/hackernewsrobot.bsky.social/post/3myyliq7yhd2t"}, {"timestamp": "2026-10-29T06:36:05.575Z", "date_only": false, "value": "2026-10-29T06:36:05.575864Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/anthroposamu.mastodon.social.ap.brid.gy/post/3myynmgpx5ga2", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ee1f3d84-7830-4972-93af-278fa72da352", "content": "GitLab security incident: attempted exploitation of CVE-2026-97229\nhttps://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\nOn October 20 and 21, an attacker tried to exploit a GitLab vulnerability on our instance, a week after the fix was released. The attack came close to [\u2026]", "url": "https://bsky.app/profile/anthroposamu.mastodon.social.ap.brid.gy/post/3myynmgpx5ga2"}, {"timestamp": "2026-10-29T08:05:39Z", "date_only": false, "value": "2026-10-29T08:05:39.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "5f3c8ce7-3ed6-4a77-b3b9-4a61ee75c0dc", "content": "An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October.\n\nThe flaw, CVE-2026-97229 (CVSS score: 10.0), can let an attacker run code on a GitLab server through a crafted regular expression in a CI configuration. Alpine found no evidence that the attack worked but", "url": "https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html"}, {"timestamp": "2026-10-29T10:14:17.853Z", "date_only": false, "value": "2026-10-29T10:14:17.853773Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pikapods.bsky.social/post/3myyzsnalv427", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "44b69210-8103-4a89-8bb5-f14539506cef", "content": "\ud83d\udd12 Alpine Linux rebuilt its GitLab server after a CVE-2026-97229 (CVSS 10.0) exploit attempt.\n\nUpgrading GitLab didn't patch their custom container image, because the fix lives in Ruby 3.3.13, 3.4.12, and 4.0.9.\n\ngo.pf7.net/XZF30 #gitlab #alpinelinux #security #opensource", "url": "https://bsky.app/profile/pikapods.bsky.social/post/3myyzsnalv427"}, {"timestamp": "2026-10-29T11:00:13.596Z", "date_only": false, "value": "2026-10-29T11:00:13.596092Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/geeknewsbot.bsky.social/post/3myz4ermdhv2i", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "c9369e8f-4bd7-48eb-92b9-0bed2db05a6a", "content": "GitLab \ubcf4\uc548 \uc0ac\uace0: CVE-2026-97229 \uc545\uc6a9 \uc2dc\ub3c4\n\nAlpine Linux\uc758 GitLab \uc778\uc2a4\ud134\uc2a4\uac00 10\uc6d4 20~21\uc77c CVE-2026-97229 \uc545\uc6a9 \uacf5\uaca9 \uc744 \ubc1b\uc74c. \uc131\uacf5 \uc99d\uac70\ub294 \uc5c6\uc9c0\ub9cc \ucf54\ub4dc \uc2e4\ud589 \uac00\ub2a5\uc131\uc744 \ubc30\uc81c\ud560 \uc218 \uc5c6\uc5b4 \uce68\ud574\ub41c \uac83\uc73c\ub85c \uac04\uc8fc\ud558\uace0 \ucc98\uc74c\ubd80\ud130 \uc7ac\uad6c\ucd95\ud568 \ucde8\uc57d\uc810\uc740 GitLab \uc790\uccb4 \ucf54\ub4dc\uac00 \uc544\ub2c8\ub77c Ruby\uc758 \uc815\uaddc\uc2dd \uc5d4\uc9c4 Onigmo \uc5d0 \uc788\uc74c. \uc790\uccb4...", "url": "https://bsky.app/profile/geeknewsbot.bsky.social/post/3myz4ermdhv2i"}, {"timestamp": "2026-10-29T11:05:47.285Z", "date_only": false, "value": "2026-10-29T11:05:47.285401Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/veduis.bsky.social/post/3myz4ooelke2z", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "59ca5b8c-84db-47ad-a7f0-10fb4026a591", "content": "CVE-2026-97229: Attacker tried to exploit Alpine Linux's GitLab a week after the fix. CVSS 10.0. Crafted regex in a CI config can run code. No evidence it succeeded.", "url": "https://bsky.app/profile/veduis.bsky.social/post/3myz4ooelke2z"}, {"timestamp": "2026-10-29T11:06:13Z", "date_only": false, "value": "2026-10-29T11:06:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/107936", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "c2cf54b0-6ec4-4b6d-b0cb-a79057eaafc1", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a gitlab-rce-toolkit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murat-levi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-29 10:40:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-97229 + CVE-2026-110264 \u2014 GitLab Onigmo RCE Exploit Toolkit (CVSS 10.0)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107936", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-29T11:15:42.432Z", "date_only": false, "value": "2026-10-29T11:15:42.432037Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3myz5agtiy42k", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "9ea02621-44fd-4312-bf14-33f909a32eff", "content": "CVE-2026-97229 enabled potential code execution via crafted CI regex, prompting Alpine to rebuild its GitLab server, reset passwords, and require Ruby patch upgrades beyond GitLab updates.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3myz5agtiy42k"}, {"timestamp": "2026-10-29T11:31:06.022Z", "date_only": false, "value": "2026-10-29T11:31:06.022170Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacks.gr/post/3myz63xd4ocbh", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "675a98bf-5804-4b78-9187-58e4e0fac006", "content": "Alpine Linux completely rebuilt its GitLab server after detecting an attacker probing a severe code execution flaw (CVE-2026-97229) using crafted CI configu\u2026\n\nhttps://en.hacks.gr/to-alpine-linux-e-stise-apo-tin-archi-kentriko-ypologisti-meta-apo-apopeira-paraviasis/\n\n#AlpineLinux #GitLab #OpenSource", "url": "https://bsky.app/profile/hacks.gr/post/3myz63xd4ocbh"}, {"timestamp": "2026-10-29T12:53:44.787Z", "date_only": false, "value": "2026-10-29T12:53:44.787505Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsyc200.bsky.social/post/3myzcpqu2vz2m", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "dd2a0b24-e1f8-4c83-a3e1-bf047c39253b", "content": "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229 https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html (http://news.ycombinator.com/item?id=50282544)", "url": "https://bsky.app/profile/newsyc200.bsky.social/post/3myzcpqu2vz2m"}, {"timestamp": "2026-10-29T13:01:04.193Z", "date_only": false, "value": "2026-10-29T13:01:04.193543Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/rubric.hrih.si/post/3myzd4tsr6d2f", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "96749ebd-b9b5-493e-b010-13c24f2a6f87", "content": "1. Apple's git still trusts the compromised eMudhra certificates (we-have-a-problem.com)\n2. Claude Code's default telemetry sends Anthropic SHA-256 hashes of files it reads (AgenticBench)\n3. GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux (alpinelinux.org)", "url": "https://bsky.app/profile/rubric.hrih.si/post/3myzd4tsr6d2f"}, {"timestamp": "2026-10-29T13:14:55Z", "date_only": false, "value": "2026-10-29T13:14:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/gitlab-security-advisory-av26-1028", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "749e3412-e95e-4d40-9967-0219635008fc", "url": "https://cyber.gc.ca/en/alerts-advisories/gitlab-security-advisory-av26-1028"}, {"timestamp": "2026-10-29T13:34:17.856Z", "date_only": false, "value": "2026-10-29T13:34:17.856543Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117524444599191375", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a9bb1acf-2be4-471c-9cf1-3116923dce3b", "content": "On October 20 and 21, an attacker tried to exploit CVE-2026-97229 against Alpine Linux's GitLab instance. \n\nWe have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with.\nhttps://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n#GitLab #CVE #eitw", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117524444599191375"}, {"timestamp": "2026-10-29T13:56:09Z", "date_only": false, "value": "2026-10-29T13:56:09.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/OE5IiZDVc4MROTdbS_TgR5aBBI2BnVExUpRGru9bxEg_Zg", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "2121747e-1307-464b-a8c1-6c5035b8a2b2"}, {"timestamp": "2026-10-29T17:24:13.279Z", "date_only": false, "value": "2026-10-29T17:24:13.279953Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3myzrtf7wqa2d", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "2f8fb800-cf3e-4b9a-93bd-a7006a14f4b1", "content": "Alpine Linux rebuilt its GitLab server after reported attempts to exploit CVE-2026-97229. It found no evidence of code execution but cannot rule it out. GitLab installations using separate Ruby must update Ruby to a fixed version.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3myzrtf7wqa2d"}, {"timestamp": "2026-10-29T17:38:58.413Z", "date_only": false, "value": "2026-10-29T17:38:58.413712Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tecnologiageek.com/post/3myzsnreo432v", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "2d5d9e8b-0930-4c0e-916e-5715db6ed354", "content": "CVE-2026-97229 de GitLab casi abre Alpine\u00a0Linux\n\nLa CVE-2026-97229 de GitLab casi le abre a un atacante el servidor de Alpine Linux, y la parte inc\u00f3moda es esta: el equipo actualiz\u00f3 dos veces y el agujero sigui\u00f3 abierto....", "url": "https://bsky.app/profile/tecnologiageek.com/post/3myzsnreo432v"}, {"timestamp": "2026-10-29T18:15:45.281Z", "date_only": false, "value": "2026-10-29T18:15:45.281501Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3myzupk5q7c2k", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ae8b96e8-fa53-4393-8f78-c2f8f9ea90ee", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-97229 \u00b7 32 people\n2. CVE-2026-76418 \u00b7 28 people\n3. CVE-2026-111497 \u00b7 27 people \ud83d\udd25\n4. CVE-2026-41709 \u00b7 24 people \ud83d\udd25\n5. CVE-2026-109618 \u00b7 23 people \ud83d\udd25\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3myzupk5q7c2k"}, {"timestamp": "2026-10-29T18:15:45.855Z", "date_only": false, "value": "2026-10-29T18:15:45.855085Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3myzupkaqv22k", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "bb3eb8cd-97c2-43cc-a12f-4bb2288bcad2", "content": "1. CVE-2026-97229 \u00b7 32 people\n\ud83d\udfe5 Critical 10.0 \u00b7 GitLab\n\nInteger Overflow or Wraparound in GitLab", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3myzupkaqv22k"}, {"timestamp": "2026-10-29T19:27:29.116Z", "date_only": false, "value": "2026-10-29T19:27:29.116027Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3myzypshg7c2x", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "cd4b4e73-ef92-4633-b5d9-7c736d16caaa", "content": "Alpine Linux Rebuilds GitLab Server After Suspected Exploitation Attempts Against CVE-2026-97229 +\u00a0Video\n\nIntroduction: A Security Incident With No Confirmed Code Execution Alpine Linux has rebuilt its GitLab server following reported attempts to exploit CVE-2026-97229. Although the investigation\u2026", "url": "https://bsky.app/profile/undercodenews.bsky.social/post/3myzypshg7c2x"}, {"timestamp": "2026-10-29T19:38:36.423Z", "date_only": false, "value": "2026-10-29T19:38:36.423460Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infonewscyber.bsky.social/post/3myzzdopz3u2y", "record": "cve-2026-97229", "field": "creation_timestamp", "uuid": "9798dffc-df35-4e20-986d-5d9fc5ececc4", "content": "\u26a0\ufe0f FAILLE CRITIQUE\n\nCVE-2026-97229 activement exploit\u00e9e : GitLab Community Edition and Enterprise Edition Integer Overflow or\u2026\n\n\ud83d\udd17 https://infonewscyber.fr/info/cve-2026-97229-activement-exploitee-gitlab-community-edition-and-enter-2dc39333ee9758ee\n#ZeroDay #CISA #Vuln\u00e9rabilit\u00e9 #Gitlab #Cybers\u00e9curit\u00e9", "url": "https://bsky.app/profile/infonewscyber.bsky.social/post/3myzzdopz3u2y"}, {"timestamp": "2026-10-29T19:53:04.142Z", "date_only": false, "value": "2026-10-29T19:53:04.142607Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trustlist.bsky.social/post/3mz225jthmz2l", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "1c6caa10-009b-4ce7-a08f-6dcbb5767a11", "content": "Security advisories 17/37\nAlpine rebuilds GitLab after CVE-2026-97229 attempt; the fix needs patched Ruby\n\nThe GitLab fix for the CVSS 10.0 regex flaw is a patch to Ruby that GitLab applies only in its own packages, so installations running\u2026\n\n#infosec #cybersecurity\ntrustlist.uk/security-advisorie\u2026", "url": "https://bsky.app/profile/trustlist.bsky.social/post/3mz225jthmz2l"}, {"timestamp": "2026-10-29T20:00:01Z", "date_only": false, "value": "2026-10-29T20:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-97229", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c00e3f8b-d015-45e1-8af3-f59f18e341bb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-29T20:00:02.526Z", "date_only": false, "value": "2026-10-29T20:00:02.526695Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c00e3f8b-d015-45e1-8af3-f59f18e341bb", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4ae3809c-ae97-4224-88a9-52b499287599", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c00e3f8b-d015-45e1-8af3-f59f18e341bb", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-29T20:01:36Z", "date_only": false, "value": "2026-10-29T20:01:36+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-97229", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "d0467039-e2c9-4517-8a12-6e19866aa546", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-29T20:01:36Z", "date_only": false, "value": "2026-10-29T20:01:36+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-97229", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "d0467039-e2c9-4517-8a12-6e19866aa546", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-29T20:01:36Z", "date_only": false, "value": "2026-10-29T20:01:36+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-97229", "field": "status.status_updated_at", "uuid": "d0467039-e2c9-4517-8a12-6e19866aa546", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-29T20:01:36.241Z", "date_only": false, "value": "2026-10-29T20:01:36.241Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-97229", "field": "evidence.0.details.added_date", "uuid": "d0467039-e2c9-4517-8a12-6e19866aa546", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-29T20:55:14.405Z", "date_only": false, "value": "2026-10-29T20:55:14.405333Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnidx-jp.bsky.social/post/3mz25mqncdx2d", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "d332c647-9b0f-4c1a-96c3-d94e47b9ef01", "content": "\u3010\u60aa\u7528\u78ba\u8a8d\u3011CVE-2026-97229\nGitLab.org\u306eGitLab\u306b\u304a\u3051\u308b\u6574\u6570\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u8106\u5f31\u6027\nGitLab Community Edition and Enterprise Edition\nCISA \u8ffd\u52a0 10/29\u30fb\u5bfe\u5fdc\u671f\u9650 11/1\nhttps://jvndb.jvn.jp/ja/contents/2026/JVNDB-2026-037883.html\n#\u8106\u5f31\u6027 #KEV #GitLab", "url": "https://bsky.app/profile/vulnidx-jp.bsky.social/post/3mz25mqncdx2d"}, {"timestamp": "2026-10-29T21:10:24.493Z", "date_only": false, "value": "2026-10-29T21:10:24.493322Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3mz26htjgza2t", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "e12397b3-4a15-4221-9f84-c89085bacd5a", "content": "GitLab vulnerability almost exploited \ud83d\udca3\n\nAlpine Linux reports an attempted exploit of CVE-2026-97229 on its GitLab instance, a critical vulnerability that nearly led to code execution.", "url": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3mz26htjgza2t"}, {"timestamp": "2026-10-29T21:20:04.946Z", "date_only": false, "value": "2026-10-29T21:20:04.946282Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mz26z42sfv2k", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "48776dc1-5e8f-40b2-b5a2-3a402941e507", "content": "CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities list (2026-10-29).\nGitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound\nEPSS today: 0.184 (no score 30 days earlier)\n#infosec #KEV", "url": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mz26z42sfv2k"}, {"timestamp": "2026-10-29T21:30:07.399Z", "date_only": false, "value": "2026-10-29T21:30:07.399258Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mz27l4b57j2r", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "2b09c316-98ef-47a7-a582-18b3bd7e84f5", "content": "\ud83d\udce2 Incident GitLab Alpine Linux : exploitation tent\u00e9e de CVE-2026-97229 (CVSS 10.0)\n\nLe 28 octobre 2026, l'\u00e9quipe Alpine Linux a publi\u00e9 un post-mortem d\u00e9taill\u00e9 sur son site officiel (alpinelinux.org) concernant une tentative\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#AlpineLinux #GitLab #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mz27l4b57j2r"}, {"timestamp": "2026-10-29T21:50:17.116Z", "date_only": false, "value": "2026-10-29T21:50:17.116938Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/patchsonar.com/post/3mz2ap5zz4c2y", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "be36fe8c-2b30-4001-93bb-2b7b9e23f428", "content": "Newly listed by CISA: GitLab Community Edition and Enterprise Edition\nGitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability\n\nWhat to do: Install the vendor's security update. If there isn't one yet, apply\u2026\n\nhttps://patchsonar.com/cve/CVE-2026-97229 #devsecops", "url": "https://bsky.app/profile/patchsonar.com/post/3mz2ap5zz4c2y"}, {"timestamp": "2026-10-29T22:15:04.467Z", "date_only": false, "value": "2026-10-29T22:15:04.467344Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mz2c3hnzxx2z", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "8b420105-f442-4d1f-b9a0-f1c6cafd3489", "content": "\ud83d\udea8 NEW on CISA KEV \u2014 exploited in the wild\nGitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerabili\nCVE-2026-97229 \u00b7 patch by 2026-11-01\n\ud83d\udd17 https://ninjasignal.ninja/intel/cve/CVE-2026-97229\n#KEV #cybersecurity #infose", "url": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mz2c3hnzxx2z"}, {"timestamp": "2026-10-29T22:55:04.409Z", "date_only": false, "value": "2026-10-29T22:55:04.409894Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/lebulletin.bsky.social/post/3mz2ecytrgq24", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "181d3c5d-15c2-4f36-b6f3-2a560d82dbd8", "content": "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229\n\nhttps://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html", "url": "https://bsky.app/profile/lebulletin.bsky.social/post/3mz2ecytrgq24"}, {"timestamp": "2026-10-30T02:49:12.517Z", "date_only": false, "value": "2026-10-30T02:49:12.517903Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mz2rfo4dsj2j", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "1527b34c-27fc-4203-8213-3461f57612cc", "content": "Critical GitLab Vulnerability CVE-2026-97229 Could Allow Unauthenticated Remote Code\u00a0Execution\n\nA newly disclosed critical vulnerability in GitLab could allow unauthenticated attackers to execute arbitrary code on vulnerable servers, potentially giving them complete control over affected\u2026", "url": "https://bsky.app/profile/undercodenews.bsky.social/post/3mz2rfo4dsj2j"}, {"timestamp": "2026-10-30T02:51:31.517Z", "date_only": false, "value": "2026-10-30T02:51:31.517892Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/forsmile.jp/post/3mz2rjsesu22u", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "9f0298c1-9c19-4344-97a8-2dbfe7712b6e", "content": "\u3010\u7dca\u6025\u3011GitLab \u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\uff08CVE-2026-97229 / CVSS 10.0\uff09\n\n\u30ed\u30b0\u30a4\u30f3\u4e0d\u8981\u3067\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3055\u308c\u308b\u6050\u308c\u300210/29\u306bCISA\u304c\u60aa\u7528\u78ba\u8a8d\u6e08\u307f\u306b\u8ffd\u52a0\u3002\n\u5bfe\u51e6: \u81ea\u5206\u3067\u904b\u7528\u3059\u308bGitLab\u306f\u6700\u65b0\u306e\u30d1\u30c3\u30c1\u7248\u3078\u300210/12\u306e\u7248\u3067\u306f\u4e0d\u5341\u5206\u3067\u3059\u3002\n\nforsmile.jp/articles/git...\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #CVE", "url": "https://bsky.app/profile/forsmile.jp/post/3mz2rjsesu22u"}, {"timestamp": "2026-10-30T03:15:00Z", "date_only": false, "value": "2026-10-30T03:15:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.se/2026/10/ncsc-cert-se-veckobrev-v44.html", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "bdaab604-59a2-42dc-930b-7e37deb14109", "url": "https://www.cert.se/2026/10/ncsc-cert-se-veckobrev-v44.html"}, {"timestamp": "2026-10-30T03:55:54.495Z", "date_only": false, "value": "2026-10-30T03:55:54.495Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-97229", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T04:01:14.104Z", "date_only": false, "value": "2026-10-30T04:01:14.104268Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mz2vghx6pt2m", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "47695df2-a0d7-453b-933d-46af23a90bca", "content": "~Cisa~\nCISA added actively exploited GitLab and Cisco Secure Firewall vulnerabilities to its KEV Catalog.\n-\nIOCs: CVE-2026-97229, CVE-2026-76418\n-\n#CISA #KEV #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mz2vghx6pt2m"}, {"timestamp": "2026-10-30T05:33:45.710Z", "date_only": false, "value": "2026-10-30T05:33:45.710369Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsyc250.bsky.social/post/3mz32lvw3xs25", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "58538df4-0bc2-42c2-9ed1-78dcc6792f73", "content": "GitLab Security Incident: Attempted Exploitation of CVE-2026-97229 https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html (http://news.ycombinator.com/item?id=50282544)", "url": "https://bsky.app/profile/newsyc250.bsky.social/post/3mz32lvw3xs25"}, {"timestamp": "2026-10-30T06:27:05Z", "date_only": false, "value": "2026-10-30T06:27:05.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "0fb99f13-a80f-41bf-8b87-2a92164f6441", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.\n\nThe vulnerabilities are listed below -\n\n\n  CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise", "url": "https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html"}, {"timestamp": "2026-10-30T06:30:20.608Z", "date_only": false, "value": "2026-10-30T06:30:20.608113Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mz35r3uvx42d", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "48c1ffff-249c-4d3a-9430-89c2c0b516d4", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-97229: \u26a0\ufe0f CVE-2026-97229: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 18.4%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-97229-gitlab-has-remediated-an-issue-in", "url": "https://bsky.app/profile/threatspotai.bsky.social/post/3mz35r3uvx42d"}, {"timestamp": "2026-10-30T06:53:51.041Z", "date_only": false, "value": "2026-10-30T06:53:51.041577Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mz36zck5e2mr", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "e81d6f7f-7a95-45b6-8d3b-910cea779c3e", "content": "GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html", "url": "https://bsky.app/profile/shiojiri.com/post/3mz36zck5e2mr"}, {"timestamp": "2026-10-30T07:31:25.062Z", "date_only": false, "value": "2026-10-30T07:31:25.062567Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aman179102.bsky.social/post/3mz3b5rawnn24", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "af73f0bf-cb4a-4e62-9701-195241f4a81c", "content": "Attacker Tried to Exploit Alpine Linux\u2019s GitLab via CVSS 10.0 Flaw Its Ruby Left Open. An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after. The flaw, CVE-2026-97229 (CVSS score: 10.0).\nSource: The Hacker News \u2014 thehackernews.com", "url": "https://bsky.app/profile/aman179102.bsky.social/post/3mz3b5rawnn24"}, {"timestamp": "2026-10-30T08:15:58.709Z", "date_only": false, "value": "2026-10-30T08:15:58.709052Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mz3dnyf6uw27", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "e10f2e4c-775f-4cfb-8ab2-9cb25b2d2716", "content": "\ud83d\udd34 Exploitation confirm\u00e9e (CISA KEV, ajouts du 29/10) \u00b7 2\n\u2022 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software CVE-2026-76418, CVSS 8.6\n\u2022 GitLab Community Edition and Enterprise Edition CVE-2026-97229, CVSS 10.0", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mz3dnyf6uw27"}, {"timestamp": "2026-10-30T08:32:27Z", "date_only": false, "value": "2026-10-30T08:32:27.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.securityweek.com/max-severity-gitlab-vulnerability-exploited-against-alpine-linux/", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4183368a-29a0-4344-824e-b97863b67a1d", "content": "Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.\n\nThe post Max-Severity GitLab Vulnerability Exploited Against Alpine Linux appeared first on SecurityWeek.", "url": "https://www.securityweek.com/max-severity-gitlab-vulnerability-exploited-against-alpine-linux/"}, {"timestamp": "2026-10-30T09:00:08.031Z", "date_only": false, "value": "2026-10-30T09:00:08.031196Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mz3g4xewcs2d", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a84b5841-2ee5-4056-9f93-7ad3a89480c7", "content": "\ud83d\udce2 [VULN] CISA : une faille GitLab CVSS 10 et un bug Cisco exploit\u00e9s - CVE-2026-97229 CVE-2026-76418\n\nL\u2019agence am\u00e9ricaine CISA a ajout\u00e9 jeudi deux vuln\u00e9rabilit\u00e9s \u00e0 son catalogue KEV. Ce registre recense, en effet, les failles exploit\u00e9es activement par des attaquants.\n\n#Vuln\u00e9rabilit\u00e9 #CVE #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mz3g4xewcs2d"}, {"timestamp": "2026-10-30T09:02:16.183Z", "date_only": false, "value": "2026-10-30T09:02:16.183917Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117529046928507415", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "00149610-6e4b-4959-bc87-24b2d015f71d", "content": "CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV\nCISA on Thursday added two actively exploited flaws to its Known Exploited Vulnerabilities catalog, The Hacker News reports: a GitLab remote code execution flaw, CVE-2026-97229, rated CVSS 10.0, and a Cisco firewall denial-of-service flaw. Both flaws were added citing evidence of active exploitation. https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html", "url": "https://infosec.exchange/users/edwardk/statuses/117529046928507415"}, {"timestamp": "2026-10-30T09:15:51.334Z", "date_only": false, "value": "2026-10-30T09:15:51.334Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-GITLAB-2026-97229", "record": "BIT-GITLAB-2026-97229", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T09:47:22.263Z", "date_only": false, "value": "2026-10-30T09:47:22.263318Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackwatch.de/post/3mz3ire2ejs2z", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "9dd538c9-2582-4de3-ad8d-f53f9a260086", "content": "GitLab CVE-2026-97229 (CVSS 10), seit 29.10. im CISA KEV. Fix: 19.4.2 / 19.3.5 / 19.2.8+. Source-Install oder eigenes Image? Dann zus\u00e4tzlich Ruby 3.3.13 / 3.4.12 / 4.0.9, sonst bleibt die L\u00fccke offen. Video und Stimme: KI-generiert.", "url": "https://bsky.app/profile/stackwatch.de/post/3mz3ire2ejs2z"}, {"timestamp": "2026-10-30T09:52:18.898Z", "date_only": false, "value": "2026-10-30T09:52:18.898150Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mz3j2aozwg2y", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "9eb2d717-1cd5-4186-a871-2d49123232ab", "content": "GitLab CE/EE\u306b\u6df1\u523b\u306a\u8106\u5f31\u6027(CVE-2026-97229)\u304c\u3042\u308a\u3001\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u307e\u3059\u3002CISA\u306f\u3053\u308c\u3092KEV\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mz3j2aozwg2y"}, {"timestamp": "2026-10-30T10:03:16.003Z", "date_only": false, "value": "2026-10-30T10:03:16.003709Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mz3jnswu5g25", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "d102825f-0944-4878-90da-44409152f4b0", "content": "CVE-2026-97229 enables unauthenticated arbitrary code execution in GitLab CI/CD via crafted regex, but Alpine\u2019s targeted attacks failed and required Ruby upgrades beyond GitLab updates.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mz3jnswu5g25"}, {"timestamp": "2026-10-30T10:10:23Z", "date_only": false, "value": "2026-10-30T10:10:23.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberDispatch/3588", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "75afd128-2531-42df-8e2e-4f546b2e37c8", "content": "CISA says attackers are exploiting CVE-2026-97229, GitLab's CVSS 10 remote code execution flaw.\n\nAn attacker tried it on Alpine Linux's own GitLab. Alpine found no proof it worked but rebuilt the server.\n\nIts GitLab upgrade missed the bug, which sits in Ruby.", "url": "https://t.me/CyberDispatch/3588", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-30T10:12:12.574Z", "date_only": false, "value": "2026-10-30T10:12:12.574269Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mz3k5s7jsy2d", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "3764b7d5-a93e-4172-833c-2b7a2fed053f", "content": "CISA added Cisco and GitLab flaws to KEV, citing active exploitation. Alpine Linux said an attempt to exploit CVE-2026-97229 failed; later attempts were blocked. FCEB agencies were advised to apply fixes by November 1, 2026.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mz3k5s7jsy2d"}, {"timestamp": "2026-10-30T10:40:32Z", "date_only": false, "value": "2026-10-30T10:40:32.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/2hZg4NDKdKlei4NmlJGHlwAhXMsxe4rgYoKSJdKhpWLOJA", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "e4a3489d-ebf4-4d01-85f5-46f1e892c196", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-30T10:40:32Z", "date_only": false, "value": "2026-10-30T10:40:32.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/2hZg4NDKdKlei4NmlJGHlwAhXMsxe4rgYoKSJdKhpWLOJA", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "56b6cf82-be80-4776-be78-0a137470ed50"}, {"timestamp": "2026-10-30T11:45:15.056Z", "date_only": false, "value": "2026-10-30T11:45:15.056958Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mz3pe7an2w2k", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "6229b08f-6e36-4a90-a6be-afaaf4ea1f3e", "content": "\ud83e\udd16 CVE-2026-97229 (CVSS 10.0): unauthenticated RCE in GitLab CE/EE via a crafted regex in CI/CD config. Fixed in 19.2.8, 19.3.5, 19.4.2. Actively exploited, added to CISA KEV Oct 29.\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97229", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mz3pe7an2w2k"}, {"timestamp": "2026-10-30T12:07:06Z", "date_only": false, "value": "2026-10-30T12:07:06.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/pphm_HackerNews/3747", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "f3742279-ed7d-4b11-ac0e-41b4a55d11ab", "content": "\ud83d\udd34 CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.\n\nThe vulnerabilities are listed below:\n\n\ud83d\udd3a CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration due to insufficient regular expression validation.\n\n\ud83d\udd3a CVE-2026-76418 (CVSS score: 8.6) - An unchecked return value to NULL pointer dereference vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition.", "url": "https://t.me/pphm_HackerNews/3747", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-30T12:15:31.583Z", "date_only": false, "value": "2026-10-30T12:15:31.583863Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mel-echosphere.bsky.social/post/3mz3r2d47nf23", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "219698e4-5f13-43d2-9878-0518b3fadb39", "content": "Alpine\u306eGitLab\u3001\u66f4\u65b0\u5f8c\u3082Ruby\u5074\u306e\u4fee\u6b63\u304c\u5165\u3089\u305a\u3001\u8106\u5f31\u306a\u307e\u307e\u3060\u3063\u305f\u306e\u304b\u3002\n\n\u81ea\u524d\u69cb\u6210\u3060\u3068\u3001\u672c\u4f53\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3060\u3051\u898b\u3066\u5b89\u5fc3\u3067\u304d\u306d\u3047\u306a\u3002\u4fee\u6b63\u304c\u3069\u306e\u90e8\u54c1\u306b\u5165\u3063\u305f\u304b\u307e\u3067\u8ffd\u3044\u305f\u3044\u3002\nhttps://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html", "url": "https://bsky.app/profile/mel-echosphere.bsky.social/post/3mz3r2d47nf23"}, {"timestamp": "2026-10-30T14:36:12.321Z", "date_only": false, "value": "2026-10-30T14:36:12.321915Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mz3yvum5cs2y", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "3a8d1060-8510-405c-bbb0-ed2aa996d761", "content": "Alpine Linux says attackers targeted its GitLab instance with CVE-2026-97229 on October 20\u201321, crashing workers. It found no evidence of code execution or repository tampering, but cannot rule out execution. The flaw remains in Ruby, and CISA added it to KEV.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mz3yvum5cs2y"}, {"timestamp": "2026-10-30T15:00:08Z", "date_only": false, "value": "2026-10-30T15:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/hnhrvrcBRBEm_2v4s33yILT9d-FgHU5-F-WjfId3dkczSA8", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "df16fa63-3673-4d41-92dd-e59b0a485a8c", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-30T15:00:08Z", "date_only": false, "value": "2026-10-30T15:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/hnhrvrcBRBEm_2v4s33yILT9d-FgHU5-F-WjfId3dkczSA8", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "19cb5e66-3c3d-44c5-a857-877374e29c3c"}, {"timestamp": "2026-10-30T15:22:23.925Z", "date_only": false, "value": "2026-10-30T15:22:23.925623Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mz43ihpgcb2j", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "cf272408-0748-4a28-ae11-7630744c26f3", "content": "Alpine Linux Confirms Targeted Attack Against GitLab Instance Using Critical CVE-2026-97229 \u2014 Worker Crashes Raise Concerns Over Possible Code Execution +\u00a0Video\n\nIntroduction: A Critical GitLab Vulnerability Becomes an Active Attack Target Alpine Linux has disclosed that attackers targeted its\u2026", "url": "https://bsky.app/profile/undercodenews.bsky.social/post/3mz43ihpgcb2j"}, {"timestamp": "2026-10-30T16:03:33Z", "date_only": false, "value": "2026-10-30T16:03:33.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/18501", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4a0cccf9-29b8-4447-b467-a583385d0d63", "content": "CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229 \u2013 gbhackers.com\n\nFri, 30 Oct 2026 20:21:27", "url": "https://t.me/MalaysiaHacktivistz/18501", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-30T16:03:34Z", "date_only": false, "value": "2026-10-30T16:03:34.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/27913", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a6824504-6b67-4097-b761-cdc382ac2961", "content": "CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229 \u2013 gbhackers.com\n\nFri, 30 Oct 2026 20:21:27", "url": "https://t.me/MalaysiaHacktivistz/27913", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-30T16:03:34Z", "date_only": false, "value": "2026-10-30T16:03:34.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/MalaysiaHacktivistz/27913", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "adc25221-c249-46ae-9b18-bc61ff6fff2a", "content": "CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229 \u2013 gbhackers.com\n\nFri, 30 Oct 2026 20:21:27", "url": "https://t.me/MalaysiaHacktivistz/27913"}, {"timestamp": "2026-10-30T16:03:35Z", "date_only": false, "value": "2026-10-30T16:03:35.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/TengkorakCyberCrewzz/16688", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "929b2104-ee24-49ef-8ead-3ecdda586a7b", "content": "CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229 \u2013 gbhackers.com\n\nFri, 30 Oct 2026 20:21:27", "url": "https://t.me/TengkorakCyberCrewzz/16688", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-30T16:13:27.453Z", "date_only": false, "value": "2026-10-30T16:13:27.453009Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/abijita.bsky.social/post/3mz46drt7ln2l", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "2fd686bb-53a0-4872-98fb-d13816b4e30d", "content": "CISA Adds GitLab CVSS 10.0 Flaw to KEV After Alpine Attack\u00a0Attempt\n\nCISA added CVE-2026-97229 to its exploited list as Alpine Linux disclosed an attack attempt that crashed GitLab workers, though it found no proof of code execution.", "url": "https://bsky.app/profile/abijita.bsky.social/post/3mz46drt7ln2l"}, {"timestamp": "2026-10-30T16:14:53Z", "date_only": false, "value": "2026-10-30T16:14:53.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8771", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "3adde068-07b9-4f0b-b20c-55e180e31c37", "content": "\u0417\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u043c \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u043e\u0439 \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439:\n\n1. Defiant \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u0443\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c WordPress \u0441\u043f\u0443\u0441\u0442\u044f \u043f\u0430\u0440\u0443 \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u0445\u043e\u0434\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 WordPress 7.1.4 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f WordPress \u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f RCE.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0435 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u043c\u0435\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u043d\u0430 \u0441\u0430\u0439\u0442\u0435, \u043d\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u00ab\u0443\u043b\u043e\u0436\u0438\u0442\u044c\u0441\u044f \u0432 \u043e\u0447\u0435\u043d\u044c \u0443\u0437\u043a\u0438\u0439 \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u043a \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u043f\u043e\u043a\u0430 WordPress \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u044f\u0434\u0440\u0430. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Wordfence, \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0430\u0442\u0430\u043a.\n\n2. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c CISA, CVE-2026-97229 \u0432 GitLab \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0443\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438. \u041e\u043d\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 CI/CD.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 CI/CD \u0438\u0437-\u0437\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Alpine Linux, 20 \u0438 21 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b \u0435\u0451 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 GitLab, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f CVE-2026-97229. \u0410\u0442\u0430\u043a\u0430 \u043d\u0435 \u0443\u0434\u0430\u043b\u0430\u0441\u044c, \u043d\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432 Linux \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 \u0441 \u043d\u0443\u043b\u044f.\n\n3. Steam \u043e\u0442 Valve \u0443\u044f\u0437\u0432\u0438\u043c\u0430 \u0434\u043b\u044f RCE ZeroClick \u043c\u0435\u0436\u0434\u0443 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u043c\u0438, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u043a \u043e\u0434\u043d\u043e\u0439 \u0438 \u0442\u043e\u0439 \u0436\u0435 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438.\n\n\u041e\u0448\u0438\u0431\u043a\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Atredis Partners.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043b\u0438\u0431\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b, \u043b\u0438\u0431\u043e \u0441\u0440\u043e\u043a \u0438\u0445 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u0441\u0442\u0435\u043a. \u041e\u0434\u043d\u0430\u043a\u043e \u0432 \u043e\u0442\u0447\u0435\u0442\u0435 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d \u0441\u0442\u0430\u0442\u0443\u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n4. Telegram \u043d\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0432\u0435\u0440\u0448\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u043e\u0434\u043d\u0438\u043c \u0449\u0435\u043b\u0447\u043a\u043e\u043c \u043c\u044b\u0448\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Rlottie, \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e \u0434\u043b\u044f \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u043d\u0438\u043c\u0430\u0446\u0438\u0438 \u0441\u0442\u0438\u043a\u0435\u0440\u043e\u0432.\n\nTrend Micro, \u0441\u043e\u043e\u0431\u0449\u0438\u0432\u0448\u0430\u044f \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0435 \u0447\u0435\u0440\u0435\u0437 ZDI, \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u00ab\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u043c\u00bb.\n\n5. Drupal \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Commerce Core, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445. CVE-2026-118539 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Commerce Core \u043e\u0442 0.0.0 \u0434\u043e 2.41 \u0438 \u043e\u0442 3.0.0 \u0434\u043e 3.3.13.\n\n6. \u0425\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 PHP2Shell \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u044d\u043a\u0440\u0430\u043d\u043e\u0432 Palo Alto Networks. \u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043f\u0430\u043d\u0435\u043b\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0430\u0442\u0430\u043a\u0438.\n\n7. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 \u0441\u0436\u0430\u0442\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 Brotli \u043e\u0442 Google. CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0432\u043e\u044e \u0431\u0430\u0437\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 KEV \u0432 \u0441\u0440\u0435\u0434\u0443. \u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0441\u0435\u0442\u0438 PoC.\n\n\u041e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u0442\u0430\u043a\u0436\u0435 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Ellio \u0438 Previdian. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 Brotli \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c.\n\n8. \u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 ZIP \u044f\u0437\u044b\u043a\u0430 Rust \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u0441 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 ZIP-\u0430\u0440\u0445\u0438\u0432\u043e\u0432.\n\n9. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043a\u043e\u0434\u0435 TCP \u044f\u0434\u0440\u0430 Linux, CVE-2026-98432 (\u0441 9,8 \u043f\u043e CVSS), \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Ubuntu, Red Hat Enterprise Linux (RHEL) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b Linux. 27 \u043e\u043a\u0442\u044f\u0431\u0440\u044f Anthropic \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430, \u0447\u0442\u043e \u0435\u0435 \u043c\u043e\u0434\u0435\u043b\u044c \u0418\u0418 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.\n\nDebian, Oracle Linux, SUSE \u0438 Amazon Linux \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u043f\u043e \u043a\u0440\u0430\u0439\u043d\u0435\u0439 \u043c\u0435\u0440\u0435, \u0434\u043b\u044f \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0432\u043e\u0438\u0445 \u044f\u0434\u0435\u0440, \u043d\u043e Ubuntu \u0438 RHEL - \u043d\u0435\u0442.\n\n10. TeamViewer \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0435 \u0440\u044f\u0434 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f RCE \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u044d\u043a\u0440\u0430\u043d\u0430 \u043f\u0440\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438.\n\n11. \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f CVE-2026-97631, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f 16 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434 \u0432 TianoCore EDK II, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043c\u0438\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u0426\u041e\u0414\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a AMI, Insyde \u0438 Phoenix, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n\n12. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442 \u0431\u044d\u043a\u0434\u043e\u0440\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f CVE-2026-42589 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 Gotenberg \u0434\u043b\u044f \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0432 PDF.\n\n13. Positive Technologies \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0430 \u0441\u0432\u043e\u0439 \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u0438\u0439 \u00ab\u0412 \u0442\u0440\u0435\u043d\u0434\u0435 VM\u00bb, \u043e\u0442\u043c\u0435\u0442\u0438\u0432: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a EoP, \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 ALPC \u0432 Windows \u2013  CVE-2026-85880 \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a RCE, \u0432 \u0448\u043b\u044e\u0437\u0430\u0445 Check Point Security Gateway \u0438 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u044d\u043a\u0440\u0430\u043d\u0430\u0445 Spark Firewall (CVE-2026-85102).", "url": "https://t.me/true_secator/8771"}, {"timestamp": "2026-10-30T17:13:14.218Z", "date_only": false, "value": "2026-10-30T17:13:14.218275Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberexpertsbrief.bsky.social/post/3mz4bonkyf726", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "72c3aa9c-f369-4a23-bc18-ceab11214e5f", "content": "Running your own GitLab? CVE-2026-97229 is now on CISA's exploited list, and Alpine Linux stayed exposed after upgrading because the fix lives in Ruby. How to check your Ruby and what to hunt for: #infosec", "url": "https://bsky.app/profile/cyberexpertsbrief.bsky.social/post/3mz4bonkyf726"}, {"timestamp": "2026-10-30T18:03:44.814Z", "date_only": false, "value": "2026-10-30T18:03:44.814678Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tritontech.bsky.social/post/3mz4eixkhye2k", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "f9c34f64-2042-4eae-a21c-9e81eee401cd", "content": "Attempted exploitation of CVE-2026-97229 was already reported in the GitLab incident note. If GitLab holds code, runners, or secrets, patching moves to incident-response speed fast. https://tcc.onl/RfEEG4ip #GitLab #AppSec", "url": "https://bsky.app/profile/tritontech.bsky.social/post/3mz4eixkhye2k"}, {"timestamp": "2026-10-30T18:15:59.548Z", "date_only": false, "value": "2026-10-30T18:15:59.548719Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mz4f6v25a22s", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "5526554b-b16e-4197-9758-a4c69103f708", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-98432 \u00b7 90 people\n2. CVE-2026-97229 \u00b7 26 people \ud83d\udd25\n3. CVE-2026-76418 \u00b7 20 people \ud83d\udd25\n4. CVE-2026-109618 \u00b7 15 people \ud83d\udd25\n5. CVE-2026-118539 \u00b7 14 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mz4f6v25a22s"}, {"timestamp": "2026-10-30T18:16:00.592Z", "date_only": false, "value": "2026-10-30T18:16:00.592219Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mz4f6v7xqs2s", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "d786be3f-3474-47d7-91ab-6bfc836800a8", "content": "2. CVE-2026-97229 \u00b7 26 people \ud83d\udd25\n\ud83d\udfe5 Critical 10.0 \u00b7 GitLab\n\nInteger Overflow or Wraparound in GitLab", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mz4f6v7xqs2s"}, {"timestamp": "2026-10-30T18:34:45.075Z", "date_only": false, "value": "2026-10-30T18:34:45.075982Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wirebrief.bsky.social/post/3mz4gagbbp22g", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "f009cf60-1ad6-44a9-954e-282a27a763f4", "content": "CISA's KEV feed added two more today (catalog 2026.10.30), so 10 exploited flaws have been added since Mon 26 Oct, this GitLab CVE-2026-97229 and Cisco's ASA/FTD CVE-2026-76418 among them. That meets our logged 65% call for a 10+ week by 22 Nov.", "url": "https://bsky.app/profile/wirebrief.bsky.social/post/3mz4gagbbp22g"}, {"timestamp": "2026-10-30T19:38:55Z", "date_only": false, "value": "2026-10-30T19:38:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/luke-codes-666/85c75a95a6bb738b0fc9bec1c7b90be2", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "314d58cf-00d4-49c7-afec-040eebf3fdcc", "content": "#!/usr/bin/env python3\n\"\"\"Fetch primary incident records and build the episode's reproducible receipts.\n\nRebuild: PATH=/var/lib/oa/venvs/lim-receipts/bin:$PATH python3 receipts/build.py\nOnly public HTML/JSON and version-tag metadata are fetched; no exploit material is used.\n\"\"\"\nfrom __future__ import annotations\n\nimport csv\nimport json\nimport os\nimport re\nimport shutil\nimport tempfile\nfrom datetime import date, datetime\nfrom pathlib import Path\n\nHERE = Path(__file__).resolve().parent\nMPL_CONFIG = Path(tempfile.mkdtemp(prefix=\".mplconfig-\", dir=HERE))\nos.environ[\"MPLCONFIGDIR\"] = str(MPL_CONFIG)\n\nimport matplotlib\nmatplotlib.use(\"Agg\")\nimport matplotlib.pyplot as plt\nimport requests\nfrom bs4 import BeautifulSoup\n\n\nRAW = HERE / \"raw\"\nRAW.mkdir(parents=True, exist_ok=True)\n\nALPINE_URL = \"https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\"\nREOPEN_URL = \"https://alpinelinux.org/posts/GitLab-reopened-after-security-incident.html\"\nGITLAB_URL = \"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/\"\nCVE_URL = \"https://cveawg.mitre.org/api/cve/CVE-2026-97229\"\nRUBY_URL = \"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/\"\nCISA_URL = \"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json\"\nHN_URL = \"https://hacker-news.firebaseio.com/v0/item/50282544.json\"\nLOBSTERS_URL = \"https://lobste.rs/s/2zsjwt/gitlab_security_incident_attempted.json\"\nREPORTING_URLS = {\n    \"securityweek_incident.html\": \"https://www.securityweek.com/max-severity-gitlab-vulnerability-exploited-against-alpine-linux/\",\n    \"thehackernews_incident.html\": \"https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html?hl=en\",\n    \"bleepingcomputer_kev.html\": \"https://www.bleepingcomputer.com/news/security/hackers-now-exploiting-max-severity-gitlab-flaw-in-attacks/amp/\",\n}\nRUBY_TAGS = {\n    \"3.3.13\": \"https://api.github.com/repos/ruby/ruby/git/ref/tags/v3_3_13\",\n    \"3.4.12\": \"https://api.github.com/repos/ruby/ruby/git/ref/tags/v3_4_12\",\n    \"4.0.8\": \"https://api.github.com/repos/ruby/ruby/git/ref/tags/v4.0.8\",\n    \"4.0.9\": \"https://api.github.com/repos/ruby/ruby/git/ref/tags/v4.0.9\",\n}\n\nSESSION = requests.Session()\nSESSION.headers.update({\n    \"User-Agent\": \"TheMinuteReport-research/1.0 (+public-source-receipts)\",\n    \"Accept-Language\": \"en-US,en;q=0.9\",\n})\n\n\ndef fetch(url: str, filename: str) -> bytes:\n    response = SESSION.get(url, timeout=60)\n    response.raise_for_status()\n    content = response.content\n    (RAW / filename).write_bytes(content)\n    return content\n\n\ndef json_source(url: str, filename: str):\n    return json.loads(fetch(url, filename))\n\n\ndef text_source(url: str, filename: str) -> str:\n    return fetch(url, filename).decode(\"utf-8\", \"replace\")\n\n\ndef write_csv(filename: str, fields: list[str], rows: list[dict]) -> None:\n    with (HERE / filename).open(\"w\", newline=\"\", encoding=\"utf-8\") as handle:\n        writer = csv.DictWriter(handle, fieldnames=fields)\n        writer.writeheader()\n        writer.writerows(rows)\n\n\ndef cell_texts(table) -> list[list[str]]:\n    return [[cell.get_text(\" \", strip=True) for cell in row.find_all([\"th\", \"td\"])]\n            for row in table.find_all(\"tr\")]\n\n\ndef main() -> None:\n    alpine_html = text_source(ALPINE_URL, \"alpine_incident.html\")\n    reopen_html = text_source(REOPEN_URL, \"alpine_reopened.html\")\n    gitlab_html = text_source(GITLAB_URL, \"gitlab_patch_release.html\")\n    ruby_html = text_source(RUBY_URL, \"ruby_regexp_fixes.html\")\n    cve = json_source(CVE_URL, \"cve_2026-97229.json\")\n    kev = json_source(CISA_URL, \"cisa_kev_catalog.json\")\n    hn = json_source(HN_URL, \"hn_story_50282544.json\")\n    lobsters = json_source(LOBSTERS_URL, \"lobsters_story_2zsjwt.json\")\n    for filename, url in REPORTING_URLS.items():\n        text_source(url, filename)\n    tag_data = {}\n    for version, url in RUBY_TAGS.items():\n        safe_version = version.replace(\".\", \"_\")\n        tag_data[version] = json_source(url, f\"ruby_tag_{safe_version}.json\")\n\n    alpine_soup = BeautifulSoup(alpine_html, \"html.parser\")\n    gitlab_soup = BeautifulSoup(gitlab_html, \"html.parser\")\n    ruby_soup = BeautifulSoup(ruby_html, \"html.parser\")\n    alpine_text = \" \".join(alpine_soup.stripped_strings)\n    gitlab_text = \" \".join(gitlab_soup.stripped_strings)\n\n    # Confirm the headline counts and dates directly in the fetched primary sources.\n    incident_match = re.search(\n        r\"This crashed GitLab worker processes (\\d+) times\\. In (\\d+) of those crashes\",\n        alpine_text,\n    )\n    assert incident_match, \"Alpine crash-count wording changed\"\n    crashes, partial = map(int, incident_match.groups())\n    assert \"The attack came close to working.\" in alpine_text\n    assert \"we cannot rule it out\" in alpine_text\n\n    patch_match = re.search(r\"On October 12, 2026, we released versions ([\\d., ]+) for GitLab\", gitlab_text)\n    assert patch_match, \"GitLab release date/version text changed\"\n    gitlab_published = date(2026, 10, 12)\n    gitlab_versions = [v.strip() for v in patch_match.group(1).split(\",\")]\n    assert gitlab_versions == [\"19.4.2\", \"19.3.5\", \"19.2.8\"]\n\n    cna = cve[\"containers\"][\"cna\"]\n    cvss = next(\n        metric[\"cvssV3_1\"][\"baseScore\"]\n        for metric in cna.get(\"metrics\", [])\n        if \"cvssV3_1\" in metric\n    )\n    assert float(cvss) == 10.0\n    affected = cna[\"affected\"][0][\"versions\"]\n    gitlab_rows = []\n    fixed_by_branch = {}\n    for entry in affected:\n        branch = entry[\"version\"]\n        fixed = entry[\"lessThan\"]\n        fixed_by_branch[branch] = fixed\n        gitlab_rows.append({\n            \"component\": \"GitLab CE/EE\",\n            \"branch\": branch,\n            \"affected_versions\": f\"all versions from {branch} before {fixed}\",\n            \"first_fixed\": fixed,\n            \"release_date\": gitlab_published.isoformat(),\n            \"delivery_note\": \"GitLab patch release; custom Ruby builds must check Ruby separately\",\n            \"source_url\": GITLAB_URL,\n        })\n    assert fixed_by_branch == {\"19.2\": \"19.2.8\", \"19.3\": \"19.3.5\", \"19.4\": \"19.4.2\"}\n\n    ruby_rows_from_page = []\n    for table in ruby_soup.find_all(\"table\"):\n        for row in cell_texts(table)[1:]:\n            if len(row) >= 6 and \"CVE-2026-93577\" in row[0] and \"CVE-2026-97229\" in row[0]:\n                ruby_rows_from_page = row\n                break\n        if ruby_rows_from_page:\n            break\n    assert ruby_rows_from_page, \"Ruby CVE-to-release table not found\"\n    cve_specific = {\n        \"4.0\": ruby_rows_from_page[3],\n        \"3.4\": ruby_rows_from_page[4],\n        \"3.3\": ruby_rows_from_page[5],\n    }\n    assert cve_specific == {\"4.0\": \"4.0.8\", \"3.4\": \"3.4.12\", \"3.3\": \"3.3.13\"}\n    recommended = {\"4.0\": \"4.0.9\", \"3.4\": \"3.4.12\", \"3.3\": \"3.3.13\"}\n    ruby_rows = []\n    for branch in (\"3.3\", \"3.4\", \"4.0\"):\n        fix = cve_specific[branch]\n        baseline = recommended[branch]\n        tag_sha = tag_data[fix][\"object\"][\"sha\"]\n        ruby_rows.append({\n            \"component\": \"Ruby used by a custom/source/container build\",\n            \"series\": branch,\n            \"CVE_97229_first_fixed_in_Ruby_table\": fix,\n            \"Ruby_release_note_recommended_baseline\": baseline,\n            \"tag_ref\": tag_data[fix][\"ref\"],\n            \"tag_commit_sha\": tag_sha,\n            \"recommended_tag_ref\": tag_data[baseline][\"ref\"],\n            \"recommended_tag_commit_sha\": tag_data[baseline][\"object\"][\"sha\"],\n            \"note\": (\"Ruby's table names 4.0.8 for this CVE; the page-wide recommendation for all four fixes is 4.0.9.\"\n                     if branch == \"4.0\" else \"Ruby release note recommends this version or later.\"),\n            \"source_url\": RUBY_URL,\n        })\n\n    # Alpine's own container tag condition is separate from GitLab's package version.\n    image_row = {\n        \"component\": \"alpinelinux/gitlab container image\",\n        \"series\": \"19.3.6 tag\",\n        \"CVE_97229_first_fixed_in_Ruby_table\": \"Ruby 3.3.13\",\n        \"Ruby_release_note_recommended_baseline\": \"Ruby 3.3.13\",\n        \"tag_ref\": \"alpinelinux/gitlab:19.3.6 published 2026-10-27\",\n        \"tag_commit_sha\": \"\",\n        \"note\": \"Alpine says any 19.3.6 image pulled before Oct 27, and all older tags, are vulnerable; re-pull 19.3.6.\",\n        \"source_url\": ALPINE_URL,\n    }\n\n    write_csv(\n        \"fix_matrix.csv\",\n        [\"component\", \"series\", \"affected_versions_or_condition\", \"first_fixed_or_recommended\", \"release_date\",\n         \"CVE_97229_first_fixed_in_Ruby_table\", \"Ruby_release_note_recommended_baseline\", \"tag_ref\", \"tag_commit_sha\",\n         \"recommended_tag_ref\", \"recommended_tag_commit_sha\", \"note\", \"source_url\"],\n        [\n            {\"component\": \"GitLab CE/EE\", \"series\": row[\"branch\"],\n             \"affected_versions_or_condition\": row[\"affected_versions\"],\n             \"first_fixed_or_recommended\": row[\"first_fixed\"], \"release_date\": row[\"release_date\"],\n             \"CVE_97229_first_fixed_in_Ruby_table\": \"\", \"Ruby_release_note_recommended_baseline\": \"\",\n             \"tag_ref\": \"\", \"tag_commit_sha\": \"\", \"recommended_tag_ref\": \"\", \"recommended_tag_commit_sha\": \"\",\n             \"note\": row[\"delivery_note\"], \"source_url\": row[\"source_url\"]}\n            for row in gitlab_rows\n        ] + [\n            {\"component\": row[\"component\"], \"series\": row[\"series\"],\n             \"affected_versions_or_condition\": \"Custom/source/container build must use a Ruby with the fix\",\n             \"first_fixed_or_recommended\": row[\"Ruby_release_note_recommended_baseline\"],\n             \"release_date\": \"2026-10-23\" if row[\"series\"] != \"4.0\" or row[\"CVE_97229_first_fixed_in_Ruby_table\"] == \"4.0.9\" else \"2026-10-22 (4.0.8 tag)\",\n             \"CVE_97229_first_fixed_in_Ruby_table\": row[\"CVE_97229_first_fixed_in_Ruby_table\"],\n             \"Ruby_release_note_recommended_baseline\": row[\"Ruby_release_note_recommended_baseline\"],\n             \"tag_ref\": row[\"tag_ref\"], \"tag_commit_sha\": row[\"tag_commit_sha\"],\n             \"recommended_tag_ref\": row[\"recommended_tag_ref\"],\n             \"recommended_tag_commit_sha\": row[\"recommended_tag_commit_sha\"],\n             \"note\": row[\"note\"], \"source_url\": row[\"source_url\"]}\n            for row in ruby_rows\n        ] + [\n            {\"component\": image_row[\"component\"], \"series\": image_row[\"series\"],\n             \"affected_versions_or_condition\": \"19.3.6 pulled before 2026-10-27; all older tags\",\n             \"first_fixed_or_recommended\": \"Re-pull 19.3.6 published 2026-10-27\",\n             \"release_date\": \"2026-10-27\",\n             \"CVE_97229_first_fixed_in_Ruby_table\": image_row[\"CVE_97229_first_fixed_in_Ruby_table\"],\n             \"Ruby_release_note_recommended_baseline\": image_row[\"Ruby_release_note_recommended_baseline\"],\n             \"tag_ref\": image_row[\"tag_ref\"], \"tag_commit_sha\": \"\", \"recommended_tag_ref\": \"\",\n             \"recommended_tag_commit_sha\": \"\",\n             \"note\": image_row[\"note\"], \"source_url\": image_row[\"source_url\"]}\n        ],\n    )\n\n    # Extract Alpine's date/event rows, then add the vendor/CVE/KEV milestones from their APIs.\n    incident_table = None\n    for table in alpine_soup.find_all(\"table\"):\n        rows = cell_texts(table)\n        if rows and rows[0][:2] == [\"Date\", \"Event\"]:\n            incident_table = rows\n            break\n    assert incident_table, \"Alpine incident timeline table not found\"\n    timeline = []\n    for date_label, event in incident_table[1:]:\n        numbers = [int(n) for n in re.findall(r\"\\d+\", date_label)]\n        if not numbers:\n            continue\n        if len(numbers) == 1:\n            iso_day = f\"2026-10-{numbers[0]:02d}\"\n            sort_day = numbers[0]\n        else:\n            iso_day = f\"2026-10-{numbers[0]:02d}/2026-10-{numbers[-1]:02d}\"\n            sort_day = numbers[0]\n        timeline.append({\"date\": iso_day, \"event\": event, \"source_url\": ALPINE_URL, \"sort_day\": sort_day})\n\n    cve_published = cve[\"cveMetadata\"][\"datePublished\"][:10]\n    kev_hits = [item for item in kev[\"vulnerabilities\"] if item.get(\"cveID\") == \"CVE-2026-97229\"]\n    assert len(kev_hits) == 1, \"Expected one CISA KEV record for CVE-2026-97229\"\n    kev_entry = kev_hits[0]\n    assert kev_entry[\"knownRansomwareCampaignUse\"] == \"Unknown\"\n    cisa_catalog_date = kev.get(\"dateReleased\", \"\")[:10]\n\n    timeline.extend([\n        {\"date\": gitlab_published.isoformat(), \"event\": \"GitLab publishes fixed releases: 19.4.2, 19.3.5 and 19.2.8.\",\n         \"source_url\": GITLAB_URL, \"sort_day\": 12},\n        {\"date\": cve_published, \"event\": \"CVE-2026-97229 published in the GitLab CNA record.\",\n         \"source_url\": CVE_URL, \"sort_day\": int(cve_published[-2:])},\n        {\"date\": kev_entry[\"dateAdded\"],\n         \"event\": f\"CISA adds CVE-2026-97229 to KEV; federal due date {kev_entry['dueDate']}.\",\n         \"source_url\": CISA_URL, \"sort_day\": int(kev_entry[\"dateAdded\"][-2:])},\n        {\"date\": \"2026-10-30\", \"event\": \"Alpine publishes reopening instructions; rebuilt service runs GitLab 19.3.7 and Ruby 3.3.13.\",\n         \"source_url\": REOPEN_URL, \"sort_day\": 30},\n    ])\n    timeline.sort(key=lambda row: (row[\"sort_day\"], row[\"event\"]))\n    for row in timeline:\n        row.pop(\"sort_day\", None)\n    write_csv(\"incident_timeline.csv\", [\"date\", \"event\", \"source_url\"], timeline)\n\n    # Compute the interval from the GitLab patch to Alpine's first probe.\n    probe_row = next(row for row in timeline if row[\"event\"] == \"Attacker registers an account and starts probing\")\n    probe_day = date.fromisoformat(probe_row[\"date\"])\n    gap_days = (probe_day - gitlab_published).days\n    assert gap_days == 8\n\n    # Thread APIs are included as contemporaneous community signals, not incident proof.\n    assert hn.get(\"id\") == 50282544 and \"CVE-2026-97229\" in hn.get(\"title\", \"\")\n    assert lobsters.get(\"url\", \"\").startswith(\"https://alpinelinux.org/\")\n\n    fig, ax = plt.subplots(figsize=(16, 9), facecolor=\"#090F20\")\n    ax.set_facecolor(\"#090F20\")\n    ax.axis(\"off\")\n    ax.text(0.5, 0.82, f\"{gap_days} CALENDAR DAYS\", ha=\"center\", va=\"center\",\n            color=\"#C6FF55\", fontsize=50, fontweight=\"bold\", transform=ax.transAxes)\n    ax.text(0.5, 0.68, \"GitLab's patch release \u2192 Alpine's first probe\", ha=\"center\", va=\"center\",\n            color=\"#F2F5FA\", fontsize=29, transform=ax.transAxes)\n    ax.plot([0.18, 0.82], [0.45, 0.45], color=\"#43516B\", linewidth=8, solid_capstyle=\"round\",\n            transform=ax.transAxes)\n    for x, title, subtitle, color in [\n        (0.18, \"OCT 12\", \"GitLab fix\", \"#C6FF55\"),\n        (0.82, \"OCT 20\", \"Alpine probing begins\", \"#FF6B5B\"),\n    ]:\n        ax.scatter([x], [0.45], s=650, color=color, edgecolor=\"#F2F5FA\", linewidth=2,\n                   transform=ax.transAxes, zorder=3)\n        ax.text(x, 0.31, title, ha=\"center\", color=\"#F2F5FA\", fontsize=25, fontweight=\"bold\",\n                transform=ax.transAxes)\n        ax.text(x, 0.23, subtitle, ha=\"center\", color=\"#9AA6B8\", fontsize=19, transform=ax.transAxes)\n    ax.text(0.5, 0.08, \"Dates from GitLab's critical release note and Alpine's incident timeline\",\n            ha=\"center\", color=\"#9AA6B8\", fontsize=15, transform=ax.transAxes)\n    fig.savefig(HERE / \"chart_patch_to_probe.png\", dpi=180, facecolor=\"#090F20\", bbox_inches=\"tight\")\n    plt.close(fig)\n\n    # Enforce the size budget on the complete receipt package.\n    total_bytes = sum(path.stat().st_size for path in HERE.rglob(\"*\") if path.is_file())\n    assert total_bytes < 25 * 1024 * 1024, f\"receipts directory exceeds 25 MB: {total_bytes} bytes\"\n\n    output_lines = [\n        f\"GitLab fixes: {fixed_by_branch['19.2']} / {fixed_by_branch['19.3']} / {fixed_by_branch['19.4']} (CVSS {float(cvss):.1f}).\",\n        \"Ruby table fix: 3.3.13 / 3.4.12 / 4.0.8; broader recommended baseline: 3.3.13 / 3.4.12 / 4.0.9.\",\n        f\"First probe: {probe_day.isoformat()}; GitLab fix: {gitlab_published.isoformat()}; gap: {gap_days} calendar days.\",\n        f\"Alpine reports {crashes} worker crashes; {partial} partial exploit progressions; code execution remains unconfirmed.\",\n        f\"CISA KEV: added {kev_entry['dateAdded']}; federal due date: {kev_entry['dueDate']}; ransomware use: {kev_entry['knownRansomwareCampaignUse']}.\",\n        f\"HN snapshot: {hn['score']} points, {hn['descendants']} descendants; story {hn['id']}.\",\n    ]\n    for line in output_lines:\n        print(line)\n\n    artifacts = {\n        \"receipts/build.py\": (\"Fetcher/parser that rebuilds source snapshots, matrices, timeline, and chart.\", output_lines[0]),\n        \"receipts/fix_matrix.csv\": (\"GitLab affected/fixed branches, custom Ruby fix versions/tags, and Alpine image exception.\", output_lines[1]),\n        \"receipts/incident_timeline.csv\": (\"Primary-source event chronology from October 12 through October 30.\", output_lines[2]),\n        \"receipts/chart_patch_to_probe.png\": (\"Dark, editor-ready chart of the 8-calendar-day patch-to-probe interval.\", output_lines[2]),\n    }\n    raw_files = sorted(path for path in RAW.iterdir() if path.is_file())\n    for path in raw_files:\n        artifacts[f\"receipts/raw/{path.name}\"] = (\n            f\"Raw public-source response saved by build.py ({path.stat().st_size} bytes).\", output_lines[3]\n        )\n    manifest = [\n        {\"file\": name, \"what\": what,\n         \"command\": \"PATH=/var/lib/oa/venvs/lim-receipts/bin:$PATH python3 receipts/build.py\",\n         \"output\": output}\n        for name, (what, output) in artifacts.items()\n    ]\n    (HERE / \"MANIFEST.json\").write_text(json.dumps(manifest, indent=2, ensure_ascii=False) + \"\\n\", encoding=\"utf-8\")\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    finally:\n        shutil.rmtree(MPL_CONFIG, ignore_errors=True)\n\n\ncomponent,series,affected_versions_or_condition,first_fixed_or_recommended,release_date,CVE_97229_first_fixed_in_Ruby_table,Ruby_release_note_recommended_baseline,tag_ref,tag_commit_sha,recommended_tag_ref,recommended_tag_commit_sha,note,source_url\nGitLab CE/EE,19.2,all versions from 19.2 before 19.2.8,19.2.8,2026-10-12,,,,,,,GitLab patch release; custom Ruby builds must check Ruby separately,https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/\nGitLab CE/EE,19.3,all versions from 19.3 before 19.3.5,19.3.5,2026-10-12,,,,,,,GitLab patch release; custom Ruby builds must check Ruby separately,https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/\nGitLab CE/EE,19.4,all versions from 19.4 before 19.4.2,19.4.2,2026-10-12,,,,,,,GitLab patch release; custom Ruby builds must check Ruby separately,https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/\nRuby used by a custom/source/container build,3.3,Custom/source/container build must use a Ruby with the fix,3.3.13,2026-10-23,3.3.13,3.3.13,refs/tags/v3_3_13,af48f08f2113db1cc4ee171f34e399d7a902151b,refs/tags/v3_3_13,af48f08f2113db1cc4ee171f34e399d7a902151b,Ruby release note recommends this version or later.,https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/\nRuby used by a custom/source/container build,3.4,Custom/source/container build must use a Ruby with the fix,3.4.12,2026-10-23,3.4.12,3.4.12,refs/tags/v3_4_12,366f5fdc00cbd2e7997e03b6654d10163ff19bad,refs/tags/v3_4_12,366f5fdc00cbd2e7997e03b6654d10163ff19bad,Ruby release note recommends this version or later.,https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/\nRuby used by a custom/source/container build,4.0,Custom/source/container build must use a Ruby with the fix,4.0.9,2026-10-22 (4.0.8 tag),4.0.8,4.0.9,refs/tags/v4.0.8,60c3d71bfbf9790229c682e26f8ec968f078c7da,refs/tags/v4.0.9,3e93b23afcec3433f6aecc34b5d832799d754238,Ruby's table names 4.0.8 for this CVE; the page-wide recommendation for all four fixes is 4.0.9.,https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/\nalpinelinux/gitlab container image,19.3.6 tag,19.3.6 pulled before 2026-10-27; all older tags,Re-pull 19.3.6 published 2026-10-27,2026-10-27,Ruby 3.3.13,Ruby 3.3.13,alpinelinux/gitlab:19.3.6 published 2026-10-27,,,,\"Alpine says any 19.3.6 image pulled before Oct 27, and all older tags, are vulnerable; re-pull 19.3.6.\",https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n\n\ndate,event,source_url\n2026-10-12,\"GitLab publishes fixed releases: 19.4.2, 19.3.5 and 19.2.8.\",https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/\n2026-10-12,GitLab releases the fix,https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n2026-10-13,CVE-2026-97229 published in the GitLab CNA record.,https://cveawg.mitre.org/api/cve/CVE-2026-97229\n2026-10-13,CVE-2026-97229 published; we upgraded to GitLab 19.3.4 instead of 19.3.5 (which had the fix) by mistake,https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n2026-10-20,Attacker registers an account and starts probing,https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n2026-10-21,\"Main attack; GitLab crashes, 502 errors and failed CI jobs\",https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n2026-10-22,Upgraded to GitLab 19.3.6,https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n2026-10-23,Attacker's account blocked; Ruby releases the fix,https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n2026-10-24,\"aports, packages and Oct 21 releases verified against outside records\",https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n2026-10-25/2026-10-26,Attacker returns and tries to get back in; attempts fail,https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n2026-10-26,Found the instance still vulnerable after the upgrade,https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n2026-10-27,GitLab closed to everyone except developers and build servers; rebuild started,https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n2026-10-28,GitLab rebuild complete; all passwords reset and GitLab's secret keys replaced,https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n2026-10-29,CISA adds CVE-2026-97229 to KEV; federal due date 2026-11-01.,https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json\n2026-10-29,\"GitLab reopened, upgraded to 19.3.7\",https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n2026-10-30,Alpine publishes reopening instructions; rebuilt service runs GitLab 19.3.7 and Ruby 3.3.13.,https://alpinelinux.org/posts/GitLab-reopened-after-security-incident.html\n", "url": "https://gist.github.com/luke-codes-666/85c75a95a6bb738b0fc9bec1c7b90be2"}, {"timestamp": "2026-10-30T20:04:08.038Z", "date_only": false, "value": "2026-10-30T20:04:08.038877Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/gridwatchsignal.bsky.social/post/3mz4labins22d", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "70e18142-9ff5-480a-b457-881cdfba9cca", "content": "New on CISA's KEV list (Oct 29): GitLab CE/EE CVE-2026-97229, unauthenticated RCE via a crafted CI/CD regex, CVSS 10.0. Deadline: Sun Nov 1.\n\nSelf-managed? Go to 19.5.1, 19.4.3, 19.3.6, 19.2.9 or later. Those also fix related RCE CVE-2026-110264, which hits older versions too.", "url": "https://bsky.app/profile/gridwatchsignal.bsky.social/post/3mz4labins22d"}, {"timestamp": "2026-10-30T20:24:10.864Z", "date_only": false, "value": "2026-10-30T20:24:10.864881Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mz4me3wdqu2b", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "e8ca10e9-d935-461d-99f7-4db5be9eac36", "content": "CISA confirmed active exploitation of GitLab flaw CVE-2026-97229, which could allow remote code execution through a crafted CI/CD regular expression. GitLab released patches and urged administrators to update.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mz4me3wdqu2b"}, {"timestamp": "2026-10-30T21:00:01Z", "date_only": false, "value": "2026-10-30T21:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-97229", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "d0467039-e2c9-4517-8a12-6e19866aa546", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-30T21:00:33.561Z", "date_only": false, "value": "2026-10-30T21:00:33.561593Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d0467039-e2c9-4517-8a12-6e19866aa546", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "5e065e06-0601-4b23-8819-78386c3e7481", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d0467039-e2c9-4517-8a12-6e19866aa546", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-30T21:37:01.726Z", "date_only": false, "value": "2026-10-30T21:37:01.726999Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mz4qgdpkzq2d", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "9da94394-08f9-40a7-a448-0b96bfd1592f", "content": "CISA Confirms Active Exploitation of Critical GitLab CI/CD Vulnerability CVE-2026-97229 +\u00a0Video\n\nIntroduction: A Dangerous Weakness in Automated Software Pipelines A newly confirmed cybersecurity threat puts GitLab environments running automated CI/CD pipelines under increased scrutiny. The U.S.\u2026", "url": "https://bsky.app/profile/undercodenews.bsky.social/post/3mz4qgdpkzq2d"}, {"timestamp": "2026-10-30T22:41:45.248Z", "date_only": false, "value": "2026-10-30T22:41:45.248217Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mariogalarza.bsky.social/post/3mz4u23mlyu2t", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "fae3250c-7b56-4a1e-844e-b58d3889b5ac", "content": "Last week I was quoted twice on this GitLab flaw \u2014 today CISA confirmed attackers are exploiting it in the wild. CVE-2026-97229: unauthenticated RCE via crafted regex in CI/CD configs. Patch NOW. https://www.linkedin.com/feed/update/urn:li:share:7522065142704951296/ #GitLab #InfoSec", "url": "https://bsky.app/profile/mariogalarza.bsky.social/post/3mz4u23mlyu2t"}, {"timestamp": "2026-10-30T23:18:16.598Z", "date_only": false, "value": "2026-10-30T23:18:16.598Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-97229", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T23:18:16.598Z", "date_only": false, "value": "2026-10-30T23:18:16.598Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2026-97229", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-31T00:00:56Z", "date_only": false, "value": "2026-10-31T00:00:56.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/45195", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "73eaebb4-9ec5-467f-aec3-e41768f59c62", "content": "Max-Severity GitLab Vulnerability Exploited Against Alpine Linux\n\nTracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.\nThe post Max-Severity GitLab Vulnerability Exploited Against Alpine Linux appeared first on SecurityWeek.\nhttps://www.securityweek.com/max-severity-gitlab-vulnerability-exploited-against-alpine-linux/", "url": "https://t.me/VulnerabilityNews/45195", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-31T00:00:56Z", "date_only": false, "value": "2026-10-31T00:00:56.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/45195", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "da076627-d752-4564-9d7e-f209036cc0ea", "content": "Max-Severity GitLab Vulnerability Exploited Against Alpine Linux\n\nTracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.\nThe post Max-Severity GitLab Vulnerability Exploited Against Alpine Linux appeared first on SecurityWeek.\nhttps://www.securityweek.com/max-severity-gitlab-vulnerability-exploited-against-alpine-linux/", "url": "https://t.me/VulnerabilityNews/45195"}, {"timestamp": "2026-10-31T00:30:31Z", "date_only": false, "value": "2026-10-31T00:30:31Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9HJ5-R43H-H3XG", "record": "GHSA-9HJ5-R43H-H3XG", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-31T01:07:23.479Z", "date_only": false, "value": "2026-10-31T01:07:23.479070Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ebansu.bsky.social/post/3mz546k677g2r", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "2f9e970c-8267-4c98-8fdd-93a10c868e0a", "content": "\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u7ba1\u7406\u30c4\u30fc\u30eb\u300cGitLab\u300d\u306e\u6df1\u523b\u306a\u8106\u5f31\u6027\u300cCVE-2026-97229\u300d\u306e\u539f\u56e0\u304c\u3001\u4f9d\u5b58\u95a2\u4fc2\u306b\u3042\u308b\u300cRuby\u300d\u306b\u8d77\u56e0\u3059\u308b\u3053\u3068\u304c\u5224\u660e\u3057\u307e\u3057\u305f\u3002Ruby\u5229\u7528\u74b0\u5883\u306b\u3082\u5f71\u97ff\u304c\u53ca\u3076\u304a\u305d\u308c\u304c\u3042\u308a\u3001\u4fee\u6b63\u7248\u304c\u516c\u958b\u3055\u308c\u3066\u3044\u307e\u3059\u3002\nhttps://www.security-next.com/192222", "url": "https://bsky.app/profile/ebansu.bsky.social/post/3mz546k677g2r"}, {"timestamp": "2026-10-31T01:07:28Z", "date_only": false, "value": "2026-10-31T01:07:28Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-97229", "record": "UBUNTU-CVE-2026-97229", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-31T03:32:42Z", "date_only": false, "value": "2026-10-31T03:32:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/monk-blade/19998aceebb801a80a45b40c61d39f45", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "97a0168c-847c-4a9f-9cbd-0b79ac97052e", "content": "# \ud83d\udc27 Linux News Roundup \u2014 31 Oct 2026\n\n*Saturday, 31 October 2026 \u00b7 covers ~27\u201331 Oct (GNOME/Fedora: ~2 weeks) \u00b7 compiled 09:00 IST*\n\n> Context: Linux 7.3 shipped 18 Oct, 7.3.1 + stable updates landed 30 Oct, and the **7.4 merge window** is open.\n\n---\n\n## \ud83d\udd25 Top Stories\n\n1. **[Fedora Linux 45 is GO \u2014 ships Tuesday 3 Nov](https://www.phoronix.com/news/Fedora-45-Ships-Next-Week)** \u2014 RC-1.4 got the \"Go\" at the 29 Oct meeting, so the release is on schedule. \u00b7 [r/linux thread](https://www.reddit.com/r/linux/comments/1xixex8/fedora_linux_45_final_is_go_and_will_release_on/) \u00b7 [Go/No-Go minutes](https://meetbot.fedoraproject.org/meeting_matrix_fedoraproject-org/2026-10-29/f45-final-go-no-go-meeting.2026-10-29-18.02.html)\n2. **[Linux 7.4 merge window: FAT32 up to 265\u00d7 faster](https://www.phoronix.com/news/Linux-7.4-Faster-FAT32)** \u2014 the headline 7.4 merge; the window also brought [AMD PerfOpt for iGPUs](https://www.phoronix.com/news/Linux-7.4-IOMMU), [Zen 6 / laptop platform work](https://www.phoronix.com/news/Linux-7.4-x86-Platform-Driver), [networking hardware pacing offload](https://www.phoronix.com/news/Linux-7.4-Networking), [EXT4 buffered iomap](https://www.phoronix.com/news/Linux-7.4-EXT4), [Rust Binder replacing C Binder](https://www.phoronix.com/news/Linux-7.4-Char-Misc) and [initial Apple M4/A18 Pro support](https://www.phoronix.com/news/Linux-7.4-SoCs). \u00b7 [r/linux](https://www.reddit.com/r/linux/comments/1xij28q/fat32_filesystem_seeing_as_much_as_265x/)\n3. **[CVE-2026-98432: Linux TCP use-after-free](https://www.penligent.ai/hackinglabs/cve-2026-98432/)** \u2014 a TCP use-after-free that Ubuntu's tracker lists as a [9.8 CVE affecting all Ubuntu versions](https://ubuntu.com/security/CVE-2026-98432); patch now. \u00b7 [HN](https://news.ycombinator.com/item?id=50299182) (63 pts, 40 comments) \u00b7 [HN #2](https://news.ycombinator.com/item?id=50287647) (39 pts, 3 comments)\n4. **[Ubuntu 27.04 \"Tenacious T-Rex\" opens; Core Desktop revived](https://www.omgubuntu.co.uk/2026/10/ubuntu-2704-opens-for-development)** \u2014 the 27.04 archive opened on 30 Oct, and Canonical is [speeding up its immutable, snap-based Ubuntu Core Desktop](https://www.phoronix.com/news/Ubuntu-Core-Desktop-2026) for that cycle. \u00b7 [r/linux](https://www.reddit.com/r/linux/comments/1xhqvku/canonical_reviving_their_immutable_ubuntu_core/)\n5. **[Easy Anti-Cheat Linux v2 lands in distros](https://github.com/CachyOS/linux-cachyos/pull/1084)** \u2014 CachyOS is adding an EACv2-ready `linux-cachyos-eac` kernel with a Secure Boot guide, and [Nobara is now EACv2-compliant](https://www.reddit.com/r/linux_gaming/comments/1xjqu8g/nobara_is_now_secureboot_and_eacv2_compliant/). \u00b7 [r/linux_gaming](https://www.reddit.com/r/linux_gaming/comments/1xgm7qi/cachyos_is_adding_a_dedicated_eacv2compatible/)\n\n---\n\n## \ud83d\udcf0 Phoronix\n\n- **[Wine 11.21 Released](https://www.phoronix.com/news/Wine-11.21-Released)** \u2014 new bi-weekly dev build with better WoW64 OpenGL performance; Wine 12.0 code freeze starts in about a month. *(30 Oct)*\n- **[PostgreSQL 19 Running Behind Schedule Due To AI/LLM Burden](https://www.phoronix.com/news/PostgreSQL-19-Late)** \u2014 the annual release slips to at least November because of the extra review load from AI-generated contributions. *(30 Oct)*\n- **[Linux Kernel Developers Considering Removal Of KGDB](https://www.phoronix.com/news/Linux-Considers-Dropping--KGDB)** \u2014 kernel developers are debating whether to remove KGDB, the in-kernel GDB debugger that has been in the kernel since 2.6.26. \u00b7 [r/linux](https://www.reddit.com/r/linux/comments/1xhxsml/linux_kernel_developers_considering_removal_of/) *(28 Oct)*\n- **[CachyOS vs. Fedora 45 vs. Ubuntu 26.10 on Ryzen 9](https://www.phoronix.com/review/cachyos-ubuntu2610-fedora45)** \u2014 new benchmarks comparing the three distros' performance. *(28 Oct)*\n- **[Hyprland 0.57 With Compiz-Inspired Wobbly Windows](https://www.phoronix.com/news/Hyprland-0.57)** \u2014 the Wayland compositor adds wobbly windows like the old Compiz effect. *(28 Oct)*\n- **[VKD3D-Proton 3.1 Released](https://www.phoronix.com/news/VKD3D-Proton-3.1)** \u2014 Valve's D3D12-on-Vulkan layer gets new features and speedups ahead of the big 3.2 release. \u00b7 [r/linux_gaming](https://www.reddit.com/r/linux_gaming/comments/1xhkj09/vkd3dproton_31_released_with_new_features_ahead/) *(28 Oct)*\n\n## \ud83d\udc7d Reddit\n\n*Reddit's JSON API returned **403** for all subreddits. These items come from the public RSS feeds (top/week), which don't include score or comment counts.*\n\n**r/linux**\n- **[systemd merges support for Rust programs](https://github.com/systemd/systemd/pull/44324)** \u2014 systemd can now include components written in Rust. \u00b7 [discussion](https://www.reddit.com/r/linux/comments/1xe9bs6/systemd_merges_support_for_rust_programs/)\n- **[KDE fixes 15-year-old bug with inaccurate USB copy notifications](https://www.phoronix.com/news/KDE-Fixes-15-Year-Old-Bugs)** \u2014 KIO now reports copy progress correctly on USB sticks and network filesystems. \u00b7 [discussion](https://www.reddit.com/r/linux/comments/1xgy9ye/kde_fixes_15_year_old_bug_over_inaccurate/) \u00b7 [KDE blog](https://blogs.kde.org/2026/10/27/fixing-kio-copy-to-usb-stick-and-network-filesystems/)\n- **[Flathub Discourse is now read-only](https://docs.flathub.org/blog/discourse-deprecation)** \u2014 Flathub support now happens only on Matrix. \u00b7 [discussion](https://www.reddit.com/r/linux/comments/1xjj9h9/flathub_discourse_is_now_readonly_support/)\n- **[eMudhra weak keys put eight CAs at risk](https://www.cnbctv18.com/technology/emudhra-admits-script-error-weak-keys-8-tls-certificates-issues-apology-20019432.htm)** \u2014 the Indian certificate authority apologised after a script error produced weak TLS keys. \u00b7 [discussion](https://www.reddit.com/r/linux/comments/1xfujfo/emudhra_apologises_after_weak_security_keys_put/)\n- **[Reverse-engineering Intel Poulsbo's PowerVR SGX535](https://www.reddit.com/r/linux/comments/1xgvcm1/i_started_reverseengineering_intel_poulsbos/)** \u2014 after 41 days of work, a hobbyist's driver runs glxgears at 1280\u00d7800 on this long-unsupported GPU.\n- **[Denmark ends its open-source office pilot quietly](https://news.lavx.hu/article/denmark-ends-open-source-office-pilot-in-silence)** \u2014 Denmark's open-source office suite pilot was dropped without an announcement. \u00b7 [discussion](https://www.reddit.com/r/linux/comments/1xfsnmh/denmark_ends_open_source_office_pilot_in_silence/)\n\n**r/linux_gaming**\n- **[Forza Horizon 3 playable via the \"Azimuth\" Xbox One translation layer](https://www.reddit.com/r/linux_gaming/comments/1xghjww/use_to_pray_for_times_likes_this_forza_horizon_3/)** \u2014 the game runs on Linux for the first time in almost ten years.\n- **[Bottles creator introduces Raven](https://useraven.org/news/introducing-raven/)** \u2014 a new project the Bottles creator says will run Windows apps faster than Wine. \u00b7 [discussion](https://www.reddit.com/r/linux_gaming/comments/1xejr5d/creator_of_bottles_introduces_raven/)\n- **[Faugus 2.5.4](https://www.reddit.com/r/linux_gaming/comments/1xifu9z/faugus_254_adds_realtime_settings_changes/)** \u2014 the game launcher adds live settings changes and loads large libraries much faster.\n\n**r/kernel** \u2014 Nothing major this week; the top posts were mostly learning and career questions.\n\n## \ud83d\udfe7 Hacker News\n\n*Algolia search for linux, kernel, ubuntu, debian, fedora, systemd, wayland, kde and gnome over the last 5 days. Few Linux stories reached the front page.*\n\n- **[I will no longer upload to NEW](https://lists.debian.org/debian-devel/2026/10/msg00263.html)** \u2014 on debian-devel, a developer says they'll stop uploading packages that go through Debian's NEW review queue. \u00b7 [HN](https://news.ycombinator.com/item?id=50256738) (239 pts, 146 comments)\n- **[CVE-2026-98432: Linux TCP Use-After-Free](https://www.penligent.ai/hackinglabs/cve-2026-98432/)** \u2014 a write-up on the risk and how to check you're patched (see Top Stories). \u00b7 [HN](https://news.ycombinator.com/item?id=50299182) (63 pts, 40 comments)\n- **[Qwenputer: a deterministic RISC-V CPU inside Qwen3.5](https://divagr.com/blog/qwenputer)** \u2014 a working RISC-V CPU built inside an LLM (adjacent to Linux rather than about it). \u00b7 [HN](https://news.ycombinator.com/item?id=50282838) (696 pts, 145 comments)\n- **[Initial Apple M4 / A18 Pro support in Linux 7.4](https://www.phoronix.com/news/Linux-7.4-SoCs)** \u2014 the first upstream support for these Apple chips. \u00b7 [HN](https://news.ycombinator.com/item?id=50253512) (22 pts, 1 comment)\n\n## \ud83e\udd9e Lobste.rs\n\n- **[Alpine: GitLab security incident (CVE-2026-97229)](https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html)** \u2014 Alpine reports that someone tried to exploit a GitLab CVE on its infrastructure. \u00b7 [discussion](https://lobste.rs/s/2zsjwt) (49 pts, 8 comments)\n- **[Filian: Fil-C binaries on Debian](https://cr.yp.to/2025/fil-c.html)** \u2014 djb on running memory-safe Fil-C builds of Debian software. \u00b7 [discussion](https://lobste.rs/s/rs6ce2) (33 pts, 1 comment)\n- **[The next circle of security hell](https://blogs.gentoo.org/mgorny/2026/10/27/the-next-circle-of-security-hell/)** \u2014 a Gentoo developer on the growing burden of security work. \u00b7 [discussion](https://lobste.rs/s/f3jpq3) (24 pts, 2 comments)\n- **[Raspberry Pi Zero 3 W and Pi 4 Model A on the way?](https://bret.dk/raspberry-pi-zero-3-w-pi-4-model-a/)** \u2014 clues point to two new Raspberry Pi boards. \u00b7 [discussion](https://lobste.rs/s/hqcvyj) (18 pts, 10 comments)\n- *Earlier this month:* **[The Netherlands is building its own Linux OS](https://www.techspot.com/news/114018-netherlands-building-own-linux-os-break-free-microsoft.html)** \u00b7 [discussion](https://lobste.rs/s/nne5uh) (86 pts, 29 comments) and **[Introducing GNOME OS Preview](https://blogs.gnome.org/adrianvovk/2026/10/16/gnome-os-preview/)** \u00b7 [discussion](https://lobste.rs/s/xwng6u) (33 pts, 17 comments)\n\n## \ud83d\udc63 GNOME\n\n- **[TWIG #272 \"Shiny Icons\"](https://thisweek.gnome.org/posts/2026/10/twig-272/)** \u2014 Files gets new placeholder icons, drops blocking I/O and fixes a security issue with emptying the trash on removable drives; Software loads icons faster; Calendar folds recurring events into one search result. *(30 Oct)*\n- **[TWIG #271 \"Good News\"](https://thisweek.gnome.org/posts/2026/10/twig-271/)** \u2014 the weekly roundup for 16\u201323 Oct, led by a new Newsflash release in GNOME Circle. *(23 Oct)*\n- **[Introducing GNOME OS Preview](https://blogs.gnome.org/adrianvovk/2026/10/16/gnome-os-preview/)** \u2014 Adrian Vovk announces a preview of GNOME OS as an OS you can actually use. *(16 Oct)*\n- **[gedit 51.0 released](https://gedit-text-editor.org/blog/2026-10-15-gedit-51.html)** \u00b7 **[Cambalache 1.2 released](https://blogs.gnome.org/xjuan/2026/10/14/cambalache-1-2-released/)** \u2014 new releases of gedit and the Cambalache UI designer. *(14\u201315 Oct)*\n- **[Sebastian Wick: Varlink observability](https://blog.sebastianwick.net/posts/systemd-varlinkctl-monitor/)** \u2014 how to monitor systemd's Varlink IPC traffic with `varlinkctl`. *(18 Oct)*\n\n## \ud83c\udfa9 Fedora Magazine\n\n*Fedora Magazine has posted nothing since 19 Oct. The F45 release announcement should follow on 3 Nov.*\n\n- **[Modernizing the console with kmscon](https://fedoramagazine.org/modernizing-the-console-with-kmscon/)** \u2014 Fedora is replacing the kernel's fbcon text console with kmscon, which runs in userspace. *(19 Oct)*\n- **[Join us for the Fedora Linux 45 Release Party!](https://fedoramagazine.org/join-us-for-the-fedora-linux-45-release-party/)** \u2014 details of the virtual release party for F45. *(16 Oct)*\n- **[Podman Test Week: Rust-based conmon v3](https://fedoramagazine.org/podman-test-week-help-test-the-rust-based-conmon-v3/)** \u2014 a call for testers for the Rust rewrite of conmon, Podman's container monitor. *(7 Oct)*\n\n## \ud83d\udfe0 OMG! Ubuntu\n\n- **[Ubuntu 27.04 'Tenacious T-Rex' opens for development](https://www.omgubuntu.co.uk/2026/10/ubuntu-2704-opens-for-development)** \u2014 the archive opened on 30 Oct and auto-sync from Debian is starting. *(30 Oct)*\n- **[Ubuntu plans firmware HWE](https://www.omgubuntu.co.uk/2026/10/ubuntu-firmware-hwe-effort-moving-forward)** \u2014 a planned `linux-firmware-hwe` package so firmware for newer kernels can't break LTS users on older kernels. *(27 Oct)*\n- **[Ghostty 1.4 is out](https://www.omgubuntu.co.uk/2026/10/ghostty-1-4-released)** \u2014 a big terminal release after seven months, with Linux performance gains and Kitty graphics protocol support. \u00b7 [r/linux](https://www.reddit.com/r/linux/comments/1xh1bet/ghostty_140_released_after_7_months_of/) *(29 Oct)*\n- **[Firefox 159 released with Wayland fixes](https://www.omgubuntu.co.uk/2026/10/firefox-159-released)** \u2014 the latest Firefox brings Linux and Wayland fixes. *(27 Oct)*\n- **[Launchpad PPAs get dedicated bug trackers](https://www.omgubuntu.co.uk/2026/10/launchpad-ppa-dedicated-bug-tracker)** \u2014 you can now file bugs against an individual PPA. *(25 Oct)*\n\n---\n\nSources: Phoronix RSS \u00b7 Reddit RSS (JSON API blocked) \u00b7 HN Algolia API \u00b7 Lobste.rs JSON \u00b7 thisweek.gnome.org + Planet GNOME \u00b7 Fedora Magazine feed \u00b7 OMG! Ubuntu feed. Points and comment counts as of 31 Oct 2026, ~09:00 IST.\n", "url": "https://gist.github.com/monk-blade/19998aceebb801a80a45b40c61d39f45"}, {"timestamp": "2026-10-31T08:13:38.608Z", "date_only": false, "value": "2026-10-31T08:13:38.608355Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sigoenbeta.bsky.social/post/3mz5tzmnmus2q", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "59090c6d-a9f9-4e0f-8de1-185f1ab76bc9", "content": "Administradores de GitLab autogestionado: CISA a\u00f1adi\u00f3 CVE-2026-97229 a su cat\u00e1logo de fallos explotados. Revisad versiones y aplicad los parches 19.4.2, 19.3.5 o 19.2.8 seg\u00fan la rama.\nwww.bleepingcomputer.com/news/securit...", "url": "https://bsky.app/profile/sigoenbeta.bsky.social/post/3mz5tzmnmus2q"}, {"timestamp": "2026-10-31T08:16:59.970Z", "date_only": false, "value": "2026-10-31T08:16:59.970662Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mz5u6q2suc2x", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "b3f94533-9f4c-4525-a638-b3f8c76316e6", "content": "[1/2] GitLab CE/EE CVE-2026-97229 (CVSS 10): RCE non autenticata via regex nella config CI/CD, ora in CISA KEV. Alpine Linux ha visto tentativi di exploit il 20-21/10 su un'istanza non patchata. #infosec", "url": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mz5u6q2suc2x"}, {"timestamp": "2026-10-31T08:17:00.449Z", "date_only": false, "value": "2026-10-31T08:17:00.449608Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mz5u6q4wak2x", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "45378260-c30b-49a4-9fed-43c30ff209cd", "content": "[1/2] GitLab CE/EE CVE-2026-97229 (CVSS 10): RCE non autenticata via regex nella config CI/CD, ora in CISA KEV. Alpine Linux ha visto tentativi di exploit il 20-21/10 su un'istanza non patchata. #infosec", "url": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mz5u6q4wak2x"}, {"timestamp": "2026-10-31T08:43:10.142Z", "date_only": false, "value": "2026-10-31T08:43:10.142529Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mz5vnj64pf25", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a5b0c8dc-ee99-4dab-8d07-182ecac456da", "content": "(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-97229 \u2013 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound\u00a0Vulnerability\n\nAn executive-level strategic brief analyzing CVE-2026-97229 for CEOs and Boards, focusing on DevOps governance,\u2026\n\nhttps://thecybermind.co/1x6z", "url": "https://bsky.app/profile/thecybermind.co/post/3mz5vnj64pf25"}, {"timestamp": "2026-10-31T08:54:55.606Z", "date_only": false, "value": "2026-10-31T08:54:55.606819Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mz5wck2m7w27", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "c047dde5-44d8-4476-b587-d239acdea2bc", "content": "(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-97229 \u2013 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound\u00a0Vulnerability\n\nAn exhaustive technical breakdown of CVE-2026-97229 targeting GitLab CI/CD pipelines, complete with multi-vendor\u2026\n\nhttps://thecybermind.co/vrrh", "url": "https://bsky.app/profile/thecybermind.co/post/3mz5wck2m7w27"}, {"timestamp": "2026-10-31T12:37:04.775Z", "date_only": false, "value": "2026-10-31T12:37:04.775675Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mz6cprve5g2j", "record": "cve-2026-97229", "field": "creation_timestamp", "uuid": "24b2cc1b-4a8a-4c55-b5c7-cb088aa5a4f1", "content": "\ud83d\udcf0 CISA Konfirmasi Celah Kritis GitLab CVE-2026-97229 Mulai Dieksploitasi Hacker, Skor CVSS 10.0\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/31/cisa-gitlab-cve-2026-97229-dieksploitasi-hacker/\n\n#cisa #cve #cybersecurity #devsecops #gitlab #keamananSiber #remoteCodeExecution #", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mz6cprve5g2j"}, {"timestamp": "2026-10-31T18:15:13.394Z", "date_only": false, "value": "2026-10-31T18:15:13.394180Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mz6vmgayn22l", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "23924b55-2a15-4d1e-9cc5-e759b30d603d", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-98432 \u00b7 53 people\n2. CVE-2026-111357 \u00b7 13 people \ud83d\udd25\n3. CVE-2026-118539 \u00b7 13 people\n4. CVE-2026-97229 \u00b7 10 people \ud83d\udd25\n5. CVE-2026-111497 \u00b7 9 people \ud83d\udd25\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mz6vmgayn22l"}, {"timestamp": "2026-10-31T18:15:15.234Z", "date_only": false, "value": "2026-10-31T18:15:15.234582Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mz6vmgq3zs2l", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "dbd13c9d-f17b-424a-8d97-6252603647c6", "content": "4. CVE-2026-97229 \u00b7 10 people \ud83d\udd25\n\ud83d\udfe5 Critical 10.0 \u00b7 GitLab\n\nInteger Overflow or Wraparound in GitLab", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mz6vmgq3zs2l"}, {"timestamp": "2026-11-01T00:00:00Z", "date_only": true, "value": "2026-11-01", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-97229", "field": "evidence.0.details.due_date", "uuid": "c00e3f8b-d015-45e1-8af3-f59f18e341bb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-01T13:31:54Z", "date_only": false, "value": "2026-11-01T13:31:54.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/S_E_Reborn/6720", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "522a6f2e-978a-4ce0-91b5-e00c5403ba8e", "content": "\u0417\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u043c \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u043e\u0439 \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439:\n\n1. Defiant \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u0443\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c WordPress \u0441\u043f\u0443\u0441\u0442\u044f \u043f\u0430\u0440\u0443 \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u0445\u043e\u0434\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 WordPress 7.1.4 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f WordPress \u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f RCE.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0435 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u043c\u0435\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u043d\u0430 \u0441\u0430\u0439\u0442\u0435, \u043d\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u00ab\u0443\u043b\u043e\u0436\u0438\u0442\u044c\u0441\u044f \u0432 \u043e\u0447\u0435\u043d\u044c \u0443\u0437\u043a\u0438\u0439 \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u043a \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u043f\u043e\u043a\u0430 WordPress \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u044f\u0434\u0440\u0430. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Wordfence, \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0430\u0442\u0430\u043a.\n\n2. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c CISA, CVE-2026-97229 \u0432 GitLab \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0443\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438. \u041e\u043d\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 CI/CD.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 CI/CD \u0438\u0437-\u0437\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Alpine Linux, 20 \u0438 21 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b \u0435\u0451 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 GitLab, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f CVE-2026-97229. \u0410\u0442\u0430\u043a\u0430 \u043d\u0435 \u0443\u0434\u0430\u043b\u0430\u0441\u044c, \u043d\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432 Linux \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 \u0441 \u043d\u0443\u043b\u044f.\n\n3. Steam \u043e\u0442 Valve \u0443\u044f\u0437\u0432\u0438\u043c\u0430 \u0434\u043b\u044f RCE ZeroClick \u043c\u0435\u0436\u0434\u0443 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u043c\u0438, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u043a \u043e\u0434\u043d\u043e\u0439 \u0438 \u0442\u043e\u0439 \u0436\u0435 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438.\n\n\u041e\u0448\u0438\u0431\u043a\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Atredis Partners.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043b\u0438\u0431\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b, \u043b\u0438\u0431\u043e \u0441\u0440\u043e\u043a \u0438\u0445 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u0441\u0442\u0435\u043a. \u041e\u0434\u043d\u0430\u043a\u043e \u0432 \u043e\u0442\u0447\u0435\u0442\u0435 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d \u0441\u0442\u0430\u0442\u0443\u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n4. Telegram \u043d\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0432\u0435\u0440\u0448\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u043e\u0434\u043d\u0438\u043c \u0449\u0435\u043b\u0447\u043a\u043e\u043c \u043c\u044b\u0448\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Rlottie, \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e \u0434\u043b\u044f \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u043d\u0438\u043c\u0430\u0446\u0438\u0438 \u0441\u0442\u0438\u043a\u0435\u0440\u043e\u0432.\n\nTrend Micro, \u0441\u043e\u043e\u0431\u0449\u0438\u0432\u0448\u0430\u044f \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0435 \u0447\u0435\u0440\u0435\u0437 ZDI, \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u00ab\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u043c\u00bb.\n\n5. Drupal \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Commerce Core, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445. CVE-2026-118539 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Commerce Core \u043e\u0442 0.0.0 \u0434\u043e 2.41 \u0438 \u043e\u0442 3.0.0 \u0434\u043e 3.3.13.\n\n6. \u0425\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 PHP2Shell \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u044d\u043a\u0440\u0430\u043d\u043e\u0432 Palo Alto Networks. \u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043f\u0430\u043d\u0435\u043b\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0430\u0442\u0430\u043a\u0438.\n\n7. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 \u0441\u0436\u0430\u0442\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 Brotli \u043e\u0442 Google. CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0432\u043e\u044e \u0431\u0430\u0437\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 KEV \u0432 \u0441\u0440\u0435\u0434\u0443. \u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0441\u0435\u0442\u0438 PoC.\n\n\u041e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u0442\u0430\u043a\u0436\u0435 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Ellio \u0438 Previdian. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 Brotli \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c.\n\n8. \u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 ZIP \u044f\u0437\u044b\u043a\u0430 Rust \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u0441 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 ZIP-\u0430\u0440\u0445\u0438\u0432\u043e\u0432.\n\n9. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043a\u043e\u0434\u0435 TCP \u044f\u0434\u0440\u0430 Linux, CVE-2026-98432 (\u0441 9,8 \u043f\u043e CVSS), \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Ubuntu, Red Hat Enterprise Linux (RHEL) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b Linux. 27 \u043e\u043a\u0442\u044f\u0431\u0440\u044f Anthropic \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430, \u0447\u0442\u043e \u0435\u0435 \u043c\u043e\u0434\u0435\u043b\u044c \u0418\u0418 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.\n\nDebian, Oracle Linux, SUSE \u0438 Amazon Linux \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u043f\u043e \u043a\u0440\u0430\u0439\u043d\u0435\u0439 \u043c\u0435\u0440\u0435, \u0434\u043b\u044f \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0432\u043e\u0438\u0445 \u044f\u0434\u0435\u0440, \u043d\u043e Ubuntu \u0438 RHEL - \u043d\u0435\u0442.\n\n10. TeamViewer \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0435 \u0440\u044f\u0434 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f RCE \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u044d\u043a\u0440\u0430\u043d\u0430 \u043f\u0440\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438.\n\n11. \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f CVE-2026-97631, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f 16 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434 \u0432 TianoCore EDK II, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043c\u0438\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u0426\u041e\u0414\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a AMI, Insyde \u0438 Phoenix, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n\n12. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442 \u0431\u044d\u043a\u0434\u043e\u0440\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f CVE-2026-42589 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 Gotenberg \u0434\u043b\u044f \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0432 PDF.\n\n13. Positive Technologies \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0430 \u0441\u0432\u043e\u0439 \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u0438\u0439 \u00ab\u0412 \u0442\u0440\u0435\u043d\u0434\u0435 VM\u00bb, \u043e\u0442\u043c\u0435\u0442\u0438\u0432: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a EoP, \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 ALPC \u0432 Windows \u2013  CVE-2026-85880 \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a RCE, \u0432 \u0448\u043b\u044e\u0437\u0430\u0445 Check Point Security Gateway \u0438 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u044d\u043a\u0440\u0430\u043d\u0430\u0445 Spark Firewall (CVE-2026-85102).", "url": "https://t.me/S_E_Reborn/6720"}, {"timestamp": "2026-11-01T20:50:19.790Z", "date_only": false, "value": "2026-11-01T20:50:19.790171Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mzboqjnq2s2v", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "36b11488-74eb-45dd-bc04-09c57c771573", "content": "We are currently tracking over 1000 GitLab instances vulnerable to CVE-2026-97229 (on @CISACyber KEV) and over 11300 instances vulnerable to CVE-2026-110264 (out of around 39K GitLab instances we see daily).  \n\nTree Map Dashboard stats (both vulns) dashboard.shadowserver.org/statistics/c...", "url": "https://bsky.app/profile/shadowserver.bsky.social/post/3mzboqjnq2s2v"}, {"timestamp": "2026-11-01T20:50:20.845Z", "date_only": false, "value": "2026-11-01T20:50:20.845580Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mzboqomrvs2v", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "e93c22ab-6184-4648-891e-e4cdd0adc108", "content": "We are currently tracking over 1000 GitLab instances vulnerable to CVE-2026-97229 (on @CISACyber KEV) and over 11300 instances vulnerable to CVE-2026-110264 (out of around 39K GitLab instances we see daily).  \n\nTree Map Dashboard stats (both vulns) dashboard.shadowserver.org/statistics/c...", "url": "https://bsky.app/profile/shadowserver.bsky.social/post/3mzboqomrvs2v"}, {"timestamp": "2026-11-01T23:48:10.412Z", "date_only": false, "value": "2026-11-01T23:48:10.412438Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mzbyoplnqb24", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "3ca382f1-0551-4c0b-a92d-ddd0da345790", "content": "Alpine Linux rebuilt its GitLab server and reset passwords after attackers targeted CVE-2026-97229, causing worker crashes. It found no package tampering or confirmed code execution, but missing logs prevented ruling out compromise.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mzbyoplnqb24"}, {"timestamp": "2026-11-02T03:46:26.738Z", "date_only": false, "value": "2026-11-02T03:46:26.738134Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mzcfys6u7u2b", "record": "cve-2026-97229", "field": "creation_timestamp", "uuid": "71109104-0704-422d-8688-fe75311517bd", "content": "\ud83d\udcf0 Alpine Linux Bangun Ulang Server GitLab Usai Percobaan Serangan RCE\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/11/02/alpine-linux-bangun-ulang-server-gitlab-serangan-rce/\n\n#alpineLinux #celahKeamanan #container #cve-2026-97229 #cyberSecurity #docker #exploit #gitlab #hacking", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mzcfys6u7u2b"}, {"timestamp": "2026-11-02T07:50:24.620Z", "date_only": false, "value": "2026-11-02T07:50:24.620603Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybercaptain.cc/post/3mzctmzkxfc24", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "72a9874d-cd6d-485d-ab66-43220d501292", "content": "Alpine Linux rebuilt its GitLab after repeated attempts to exploit CVE-2026-97229, despite installing an unpatched GitLab version and bundling an unpatched Ruby.\n\n#SupplyChain #GitLab", "url": "https://bsky.app/profile/cybercaptain.cc/post/3mzctmzkxfc24"}, {"timestamp": "2026-11-02T08:11:59.745Z", "date_only": false, "value": "2026-11-02T08:11:59.745298Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mzcutmviww2i", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "94fdb6c2-6fb3-40a6-b392-68e13f4fbc8d", "content": "Top 3 CVE for last 7 days:\nCVE-2026-98432: 538 interactions\nCVE-2026-109618: 160 interactions\nCVE-2026-111497: 148 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-98432: 44 interactions\nCVE-2026-97229: 13 interactions\nCVE-2026-110264: 9 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mzcutmviww2i"}, {"timestamp": "2026-11-02T08:16:35.768Z", "date_only": false, "value": "2026-11-02T08:16:35.768038Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thebadgamer.bsky.social/post/3mzcv3thipl2q", "record": "cve-2026-97229", "field": "creation_timestamp", "uuid": "241c4ec0-d409-493a-8570-db36185e97a4", "content": "GitLab\u2019s official fixes include a Ruby patch that Alpine\u2019s custom image missed, leaving its upgraded server exposed and prompting a rebuild and password resets.\n\n#cybersecurity\u2026\nhttps://www.trickyworld.in/computer-tricks/cyber-security/cve-2026-97229-gitlab-update-missed-ruby-fix/?utm_medium=social", "url": "https://bsky.app/profile/thebadgamer.bsky.social/post/3mzcv3thipl2q"}, {"timestamp": "2026-11-02T13:30:16.800Z", "date_only": false, "value": "2026-11-02T13:30:16.800", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-97229", "record": "FKIE_CVE-2026-97229", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-02T18:00:07Z", "date_only": false, "value": "2026-11-02T18:00:07.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8775", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ed872950-8f79-4b68-9d05-e04678704679", "content": "\u0411\u043e\u043b\u0435\u0435 1000 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 GitLab \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u044b \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u0441 RCE.\n\nCVE-2026-97229 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0438 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 CI/CD, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u0438 \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440\u0430.\n\n\u041f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 GitLab \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 CI/CD \u0438\u0437-\u0437\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439\n\nGitLab 12 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u044d\u0442\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 GitLab Community Edition (CE) \u0438 Enterprise Edition (EE) 19.4.2, 19.3.5 \u0438 19.2.8. \u041d\u0430 GitLab.com \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f. \u041a\u043b\u0438\u0435\u043d\u0442\u0430\u043c GitLab Dedicated \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043d\u0435 \u043d\u0443\u0436\u043d\u043e.\n\n\u0412 \u043f\u044f\u0442\u043d\u0438\u0446\u0443 CISA \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445, \u0434\u043e\u0431\u0430\u0432\u0438\u0432 CVE-2026-97229 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 KEV.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e GitLab \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0438 \u043d\u0435\u0434\u0435\u043b\u0438 \u043d\u0430\u0437\u0430\u0434, \u0432 Shadowserver \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442 \u0431\u043e\u043b\u0435\u0435 1000 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 GitLab \u0431\u0435\u0437 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0435\u043f\u0435\u0440\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u044e\u0442\u0441\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c.\n\nCVE-2026-97229 - \u044d\u0442\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0438\u0437 \u0441\u0435\u0440\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 GitLab, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0433\u043e\u0434\u0430 \u043f\u043e\u0441\u043b\u0435 \u044f\u043d\u0432\u0430\u0440\u0441\u043a\u043e\u0439 CVE-2026-0723 (\u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c 2Fa) \u0438 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0439 CVE-2026-85706 (\u0432 API \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432).\n\n\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 \u0442\u0430\u043a\u0436\u0435 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0435\u0449\u0435 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0430 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CVE-2026-110264), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u0445.\n\n\u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f Shadowserver \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 1000 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 GitLab, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043a CVE-2026-97229 \u0438 \u0431\u043e\u043b\u0435\u0435 11300 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043a CVE-2026-110264.", "url": "https://t.me/true_secator/8775", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-02T18:10:46.954Z", "date_only": false, "value": "2026-11-02T18:10:46.954930Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117548190640380561", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "889abc1e-a2c6-4d97-870c-c30243469573", "content": "\ud83d\udea8 More than 1,000 GitLab servers remain exposed to an actively exploited RCE flaw; CVE-2026-97229\nThe CVSS 10.0 vulnerability allows an unauthenticated attacker to execute arbitrary code through a malicious regular expression inside a CI/CD configuration.\u2800\u2022 CVSS: 10.0\u2022 Affected: GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2\u2022 Fixed: 19.2.8, 19.3.5 and 19.4.2\u2022 Active exploitation: Confirmed\u2800CISA added the flaw to its Known Exploited Vulnerabilities catalog after attacks were detected. \nShadowserver is still tracking more than 1,000 vulnerable internet-facing instances.\nSource: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117548190640380561"}, {"timestamp": "2026-11-02T18:51:05.811Z", "date_only": false, "value": "2026-11-02T18:51:05.811527Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hey-kira.bsky.social/post/3mzdykgh4ke2p", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ee8f919c-f863-459b-b5ff-5f8a6d26e31d", "content": "Fix versions, since the headline stops at the count: 19.4.2, 19.3.5 and 19.2.8, per GitLab's patch release notes. CVE-2026-97229 sits in CISA's KEV, so exploited rather than theoretical. Unauthenticated RCE through the CI/CD regex compiler - triage internet-facing instances first.", "url": "https://bsky.app/profile/hey-kira.bsky.social/post/3mzdykgh4ke2p"}, {"timestamp": "2026-11-02T21:20:08.654Z", "date_only": false, "value": "2026-11-02T21:20:08.654870Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/jbhall56/statuses/117548773392408309", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "f6b1863b-bf74-43d5-8b88-83efaf7e8b75", "content": "Tracked as CVE-2026-97229, this vulnerability stems from an integer overflow weakness and was discovered in the CI/CD Regular Expression Compiler, which parses and evaluates regular expressions in pipeline configuration files. https://www.bleepingcomputer.com/news/security/over-1-000-gitlab-servers-vulnerable-to-code-execution-attacks/", "url": "https://infosec.exchange/users/jbhall56/statuses/117548773392408309"}, {"timestamp": "2026-11-02T21:24:13.842Z", "date_only": false, "value": "2026-11-02T21:24:13.842489Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mzeb4afngi2d", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "d3ccd1d7-4f9a-4eb2-954b-9b16cbd7c915", "content": "More than 1,000 internet-exposed GitLab servers remain unpatched against CVE-2026-97229, an actively exploited flaw that can enable unauthenticated remote code execution. GitLab released patches, and CISA added the flaw to its KEV Catalog.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mzeb4afngi2d"}, {"timestamp": "2026-11-02T21:30:16.411Z", "date_only": false, "value": "2026-11-02T21:30:16.411146Z", "kind": "sighting", "label": "Seen", "source": "https://ksrc.karenit.net/blog/security-alert/critical-unauthenticated-remote-code-execution-in-gitlab-ce", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ab3cc82c-23df-42d6-a9a1-c9d8022aa1c9", "url": "https://ksrc.karenit.net/blog/security-alert/critical-unauthenticated-remote-code-execution-in-gitlab-ce"}, {"timestamp": "2026-11-02T22:06:00.930Z", "date_only": false, "value": "2026-11-02T22:06:00.930979Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mzedgxfo2q2j", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "8062a4e9-974f-459f-b3ce-fccaa791e76f", "content": "An attacker attempted to exploit a critical GitLab vulnerability (CVE-2026-97229, CVSS 10.0) on Alpine Linux's GitLab server shortly after a fix was released. Although no successful exploit was confirmed, Alpine rebuilt the server and reset passwords as a precaution.", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mzedgxfo2q2j"}, {"timestamp": "2026-11-03T01:20:52.501Z", "date_only": false, "value": "2026-11-03T01:20:52.501319Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mzeodfzryr2x", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "957152f1-f147-49b2-a617-5db5f3206719", "content": "\ud83e\udd16 CVE-2026-97229 (CVSS 10.0): unauth RCE in GitLab CE/EE 19.2\u201319.4 via a crafted CI/CD regex (integer overflow in the regexp compiler). Actively exploited, in CISA KEV. 1,000+ servers still unpatched. Fix: 19.2.8 / 19.3.5 / 19.4.2.\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97229", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mzeodfzryr2x"}, {"timestamp": "2026-11-03T02:27:56Z", "date_only": false, "value": "2026-11-03T02:27:56.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-97229.yaml", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "3bd6de1c-b0eb-480e-80df-ec0ddf2999b7", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-97229.yaml"}, {"timestamp": "2026-11-03T03:05:10.375Z", "date_only": false, "value": "2026-11-03T03:05:10.375453Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/densuke.bsky.social/post/3mzeu5q73uc2i", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "29effa20-dcb6-4fcf-882e-d5b77ed6a2f4", "content": "\u66f4\u65b0\u3055\u308c\u305f\u3088\u3001\u898b\u306b\u6765\u3066\u306d!\u2192 \n\nGitLab CVE-2026-97229 \u306f KEV \u306e\u671f\u9650\u65e5\u306b1000\u53f0\u8d85\u3001Fedora 45 \u306f11\u67083\u65e5\u306e\u51fa\u8377\u4e88\u5b9a\u3001Linux 7.2 \u7cfb\u306f 7.2.15 \u3067\u7d42\u4e86\u3001Langflow \u306f 1.13.0 \u3067\u4fee\u6b63\u6e08\u307f\u3001LXD \u306e\u8a3c\u660e\u66f8\u30c1\u30a7\u30fc\u30f3\u306e\u7a74\uff082026/11/03 Linux\u30fbOSS\u30c8\u30ec\u30f3\u30c9\uff09 https://blog.fuga.jp/posts/2026-11-03-linux-oss-trend/\n#nvd #alpine #kev #cve #ptrace", "url": "https://bsky.app/profile/densuke.bsky.social/post/3mzeu5q73uc2i"}, {"timestamp": "2026-11-03T03:14:05.341Z", "date_only": false, "value": "2026-11-03T03:14:05.341091Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mzeuntx4yg2a", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4982a2ba-8f5b-412d-81b1-e4eec74a5ea4", "content": "The latest update for #Foresiet includes \"CVE-2026-97229: Alpine #Linux GitLab Security Incident\" and \"CISA: Ransomware Gangs Now Exploit Critical VMware vCenter Flaw\".\n \n#cybersecurity #infosec https://opsmtrs.com/3J3CMGz", "url": "https://bsky.app/profile/opsmatters.com/post/3mzeuntx4yg2a"}, {"timestamp": "2026-11-03T08:31:08.184Z", "date_only": false, "value": "2026-11-03T08:31:08.184093Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mzfgerj5eh2h", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "49b2663f-83b4-47ba-ba3c-8ecd9dab23b7", "content": "Top 3 CVE for last 7 days:\nCVE-2026-98432: 562 interactions\nCVE-2026-111497: 106 interactions\nCVE-2026-109618: 95 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-98432: 24 interactions\nCVE-2026-97229: 9 interactions\nCVE-2026-120277: 8 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mzfgerj5eh2h"}, {"timestamp": "2026-11-03T17:40:29.219Z", "date_only": false, "value": "2026-11-03T17:40:29.219973Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/intelnightowl.bsky.social/post/3mzgf333jso2m", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "12873919-c23d-4fcb-bf83-dadb0138e22c", "content": "Alpine Linux will rebuild GitLab packages to mitigate the CVE-2026-97229 remote code execution vulnerability. #AlpineLinux #GitLab #CVE202697229 #RCE #LinuxSecurity https://www.bleepingcomputer.com/news/security/alpine-linux-rebuilds-gitlab-after-attempted-rce-attack/", "url": "https://bsky.app/profile/intelnightowl.bsky.social/post/3mzgf333jso2m"}, {"timestamp": "2026-11-03T19:15:57.586Z", "date_only": false, "value": "2026-11-03T19:15:57.586287Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mzgkfrjvm226", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ec5d94c9-c167-475e-b7da-9b2771a51952", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-98432 \u00b7 71 people\n2. CVE-2026-58115 \u00b7 23 people\n3. CVE-2026-97229 \u00b7 10 people \ud83d\udd25\n4. CVE-2026-86596 \u00b7 9 people\n5. CVE-2026-109618 \u00b7 6 people \ud83d\udd25\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mzgkfrjvm226"}, {"timestamp": "2026-11-03T19:15:59.291Z", "date_only": false, "value": "2026-11-03T19:15:59.291649Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mzgkfrqngc26", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "131a49d0-4a44-40c8-9eec-4121d8cdfa9e", "content": "3. CVE-2026-97229 \u00b7 10 people \ud83d\udd25\n\ud83d\udfe5 Critical 10.0 \u00b7 GitLab\n\nInteger Overflow or Wraparound in GitLab", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mzgkfrqngc26"}, {"timestamp": "2026-11-03T20:00:08Z", "date_only": false, "value": "2026-11-03T20:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/108878", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a469bc4d-244f-464e-a338-29a01e8565c8", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-97229-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a emc-kk\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-03 19:23:30\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-97229 lab \u2014 Onigmo repeat integer overflow RCE (GitLab CE 19.2\u201319.4)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/108878", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-03T20:00:08Z", "date_only": false, "value": "2026-11-03T20:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/108878", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "476f0ad2-37b1-4b8c-b1bf-a99fe2c9849f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-97229-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a emc-kk\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-03 19:23:30\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-97229 lab \u2014 Onigmo repeat integer overflow RCE (GitLab CE 19.2\u201319.4)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/108878"}, {"timestamp": "2026-11-03T20:38:24.169Z", "date_only": false, "value": "2026-11-03T20:38:24.169000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.6.release_date", "linked_record": true}, {"timestamp": "2026-11-03T20:38:24.169Z", "date_only": false, "value": "2026-11-03T20:38:24.169000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.38.release_date", "linked_record": true}, {"timestamp": "2026-11-03T20:38:24.169Z", "date_only": false, "value": "2026-11-03T20:38:24.169000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.40.release_date", "linked_record": true}, {"timestamp": "2026-11-03T20:40:10.100Z", "date_only": false, "value": "2026-11-03T20:40:10.100000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.5.release_date", "linked_record": true}, {"timestamp": "2026-11-03T20:40:10.100Z", "date_only": false, "value": "2026-11-03T20:40:10.100000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.37.release_date", "linked_record": true}, {"timestamp": "2026-11-03T20:40:10.100Z", "date_only": false, "value": "2026-11-03T20:40:10.100000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.39.release_date", "linked_record": true}, {"timestamp": "2026-11-03T20:44:45.606Z", "date_only": false, "value": "2026-11-03T20:44:45.606619+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.6.discovery_date", "linked_record": true}, {"timestamp": "2026-11-03T20:44:45.606Z", "date_only": false, "value": "2026-11-03T20:44:45.606619+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.38.discovery_date", "linked_record": true}, {"timestamp": "2026-11-03T20:44:45.606Z", "date_only": false, "value": "2026-11-03T20:44:45.606619+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.40.discovery_date", "linked_record": true}, {"timestamp": "2026-11-03T21:15:54.948Z", "date_only": false, "value": "2026-11-03T21:15:54.948758+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.5.discovery_date", "linked_record": true}, {"timestamp": "2026-11-03T21:15:54.948Z", "date_only": false, "value": "2026-11-03T21:15:54.948758+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.37.discovery_date", "linked_record": true}, {"timestamp": "2026-11-03T21:15:54.948Z", "date_only": false, "value": "2026-11-03T21:15:54.948758+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.39.discovery_date", "linked_record": true}, {"timestamp": "2026-11-04T04:57:35.093Z", "date_only": false, "value": "2026-11-04T04:57:35.093574Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mzhkvti73x2x", "record": "cve-2026-97229", "field": "creation_timestamp", "uuid": "ea9190bd-708a-48c7-b0a3-5684791fcf66", "content": "\ud83d\udcf0 Lebih dari 1.000 Server GitLab Masih Rentan terhadap Serangan RCE, CISA Konfirmasi Eksploitasi Aktif\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/11/04/ribuan-server-gitlab-rentan-serangan-rce-cve-2026-97229/\n\n#cisa #cve #cybersecurity #devsecops #gitlab #hacker #keamananSiber", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mzhkvti73x2x"}, {"timestamp": "2026-11-04T16:45:20.649Z", "date_only": false, "value": "2026-11-04T16:45:20.649740Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzishelywysw", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "6ca6fc79-4d27-4568-ab71-0781022ba0cd", "content": "CISA KEV | CVE-2026-97229 | GitLab / Community Edition and Enterprise Edition\n\nCISA lists this vulnerability as exploited in the wild. Check affected products and vendor guidance.\n\nSource: CISA KEV\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1368", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzishelywysw"}, {"timestamp": "2026-11-04T18:52:09.590Z", "date_only": false, "value": "2026-11-04T18:52:09.590468Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hey-kira.bsky.social/post/3mzizk2umi422", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ef33dc60-5cc8-4933-8a63-a12d65ad3f4e", "content": "Vendor guidance here is an out-of-band patch: per GitLab's patch release notes, 19.4.2, 19.3.5 and 19.2.8 close CVE-2026-97229. Worth treating as urgent if you self-host - BleepingComputer counted over 1,000 unpatched, internet-exposed instances.", "url": "https://bsky.app/profile/hey-kira.bsky.social/post/3mzizk2umi422"}, {"timestamp": "2026-11-04T22:37:22.085Z", "date_only": false, "value": "2026-11-04T22:37:22.085795Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/digitalmatters.bsky.social/post/3mzjg4uc45s2d", "record": "cve-2026-97229", "field": "creation_timestamp", "uuid": "c40d29cc-726c-498c-a98e-48c7c76567d5", "content": "GitLab Vulnerability CVE-2026-97229 Is Being Exploited: Why 19.4.2 Is Not\u00a0Enough\n\nA critical GitLab vulnerability, CVE-2026-97229, is being exploited. CISA added it to its Known Exploited\u2026\n\nhttps://digitalmatters.me/security/gitlab-cve-2026-97229-kev/\n\n#Cyber_Security #Developer_Tools #Open_Source", "url": "https://bsky.app/profile/digitalmatters.bsky.social/post/3mzjg4uc45s2d"}, {"timestamp": "2026-11-05T14:25:09.367Z", "date_only": false, "value": "2026-11-05T14:25:09.367346Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/xploitdigest-kev.bsky.social/post/3mzl33nte6525", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "2fc45163-2587-46a2-89dc-349f99c6a67a", "content": "Do you run GitLab Community Edition and Enterprise Edition?\n\nCISA lists CVE-2026-97229 as exploited (added 29 Oct 2026).\n\nCan it reach you? Over a network, with no login and no click. CVSS 10.0.\n\nPlain-English breakdown:\nxploitdigest.com/kev/CVE-2026-97229\n\n#GitLab #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/xploitdigest-kev.bsky.social/post/3mzl33nte6525"}, {"timestamp": "2026-11-05T14:55:44.470Z", "date_only": false, "value": "2026-11-05T14:55:44.470230Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hey-kira.bsky.social/post/3mzl4sdi6fz2a", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "430a5188-635f-4868-ac9f-95d3c1b89777", "content": "The patch versions are the useful part: GitLab's out-of-band releases 19.4.2, 19.3.5 and 19.2.8 fix CVE-2026-97229, per the GitLab patch release notes. Reporting on Shadowserver data still counts over 1,000 unpatched internet-exposed instances - worth checking your own version first.", "url": "https://bsky.app/profile/hey-kira.bsky.social/post/3mzl4sdi6fz2a"}, {"timestamp": "2026-11-05T19:43:49Z", "date_only": false, "value": "2026-11-05T19:43:49+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-05T19:43:49Z", "date_only": false, "value": "2026-11-05T19:43:49+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T19:43:49Z", "date_only": false, "value": "2026-11-05T19:43:49+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "vulnerabilities.2.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T19:44:00Z", "date_only": false, "value": "2026-11-05T19:44:00+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-05T19:44:00Z", "date_only": false, "value": "2026-11-05T19:44:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T19:44:00Z", "date_only": false, "value": "2026-11-05T19:44:00+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "vulnerabilities.9.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T19:44:05Z", "date_only": false, "value": "2026-11-05T19:44:05+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-05T19:44:05Z", "date_only": false, "value": "2026-11-05T19:44:05+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T19:44:05Z", "date_only": false, "value": "2026-11-05T19:44:05+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "vulnerabilities.9.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T19:44:20Z", "date_only": false, "value": "2026-11-05T19:44:20+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-05T19:44:20Z", "date_only": false, "value": "2026-11-05T19:44:20+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T19:44:20Z", "date_only": false, "value": "2026-11-05T19:44:20+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "vulnerabilities.7.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T21:26:17Z", "date_only": false, "value": "2026-11-05T21:26:17+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-05T22:43:29.250Z", "date_only": false, "value": "2026-11-05T22:43:29.250000Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/gridwatchsignal.bsky.social/post/3mzlwwpx3kk2m", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "65e93bf4-0880-4159-b07f-54710b88cd2d", "content": "GitLab CVE-2026-97229: unauthenticated RCE via crafted CI/CD regex. Go to 19.5.1, 19.4.3, 19.3.6 or 19.2.9; earlier patches (19.4.2/19.3.5/19.2.8) may leave sibling CVE-2026-110264 (CVSS 10.0) open. Source builds: Ruby 3.3.13/3.4.12/4.0.9+.", "url": "https://bsky.app/profile/gridwatchsignal.bsky.social/post/3mzlwwpx3kk2m"}, {"timestamp": "2026-11-06T05:05:58.429Z", "date_only": false, "value": "2026-11-06T05:05:58.429412Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mzmmcoszsp2o", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ceb151d8-3f86-4256-bade-b12fc230c594", "content": "The latest update for #Foresiet includes \"Cyber Attacks October 2026: 36 KEVs, #AI Agents | Foresiet\" and \"CVE-2026-97229: Alpine #Linux GitLab Security Incident\".\n \n#cybersecurity #infosec https://opsmtrs.com/3J3CMGz", "url": "https://bsky.app/profile/opsmatters.com/post/3mzmmcoszsp2o"}, {"timestamp": "2026-11-06T08:04:26.561Z", "date_only": false, "value": "2026-11-06T08:04:26.561492Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinity.sh/post/3mzmwbsnb4w2o", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ac5a0452-807e-4eba-801a-105dbe1b8097", "content": "CVE-2026-97229: unauthenticated RCE in GitLab CI/CD via crafted regex.\n\nCVSS 10.0. CISA KEV. Rapid7 reproduced with PoC.\n\nNew post: ", "url": "https://bsky.app/profile/trinity.sh/post/3mzmwbsnb4w2o"}, {"timestamp": "2026-11-06T08:27:26.566Z", "date_only": false, "value": "2026-11-06T08:27:26.566579Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mzmxkwfgd42q", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "5801a014-9ff7-4456-9dad-dd6d00dc4563", "content": "Top 3 CVE for last 7 days:\nCVE-2026-98432: 576 interactions\nCVE-2026-83844: 63 interactions\nCVE-2026-97229: 51 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-83844: 51 interactions\nCVE-2026-107441: 25 interactions\nCVE-2026-98432: 20 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mzmxkwfgd42q"}, {"timestamp": "2026-11-06T16:43:29.709Z", "date_only": false, "value": "2026-11-06T16:43:29.709748Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-d1a6c9e6-8e63099de9f75bce", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "c397fe0d-39b5-4d0f-ba05-51c9f3223875", "content": "This Week in Security: More Linux Bugs, Biggest Crypto Theft Ever, Prusa Printers, Residential Proxies\nLinux kernel bugs which can be triggered remotely, without any login, are rare. Most kernel vulnerabilities need an attacker to already be running code on the machine. CVE-2026-98432 is one of those: a use-after-free in the IPv4 TCP handshake code, rated CVSS 9.8, which Atlas has written up in detail. It goes all the way back to Linux 4.4.\nA use-after-free is exactly what it sounds like: the program releases a chunk of memory, but some other code keeps using it. If an attacker can get their own data placed into that freed memory before it\u2019s used again, they can influence what the kernel does next. In this case, when a server accepts a connection whose SYN packet carries IPv4 header options (a rarely used feature of IPv4), the kernel hands those options from the half-open connection to the full connection without copying them, then frees them while another CPU core may still be reading them. The fix is a four-line change, from \u201ckfree()\u201d to \u201ckfree_rcu()\u201d, which waits until every reader is done before freeing the memory. A lost race simply fails the handshake, so an attacker can keep trying.\nThe bug was reported by Xinyang Ge at Anthropic, and Anthropic says its Claude model wrote a working proof-of-concept that gets root on \u201cLinux servers with a multipath TCP listener.\u201d Multipath TCP (MPTCP) lets a single connection use several network paths at once, like WiFi and cellular, and you might assume almost nobody runs it on servers. Unfortunately, as Marcus Hutchins points out, Debian kernels enable MPTCP by default, and Go 1.24 and newer open MPTCP listening sockets by default when the kernel allows it, so anything built in Go (including the Caddy web server) is potentially exposed. Hutchins\u2019 scans found about 2.1 million servers reachable over MPTCP on port 443, and he\u2019s already seeing scanning from residential proxies and Russian VPNs which looks like it\u2019s specifically hunting for this bug.\nUpstream stable kernels were fixed in mid October, but as of October 31, Ubuntu and Red Hat were both still listed as vulnerable, with fixes in progress. If you can\u2019t patch yet, you can check for MPTCP listeners with \u201css -Mlnp\u201d, and disable MPTCP with \u201csysctl net.mptcp.enabled=0\u201d, but note that this doesn\u2019t affect sockets which are already open, so you\u2019ll need to restart any services using them. Red Hat and AlmaLinux have also published firewall rules which drop TCP packets carrying IPv4 options, which basically no legitimate traffic uses.\nWe haven\u2019t seen bulk exploitation of this vulnerability yet, which might hint that it\u2019s less trivial to trigger than the severity might indicate, but it\u2019s a great time to get servers up to date. \u201cNot exploited yet\u201d has a nasty habit of turning into \u201cevery vulnerable server exploited in a day\u201d.\nMeanwhile, on the local side, OpenAI has published the results of pointing an automated pipeline, built on an unreleased \u201ccyber-focused\u201d model, at the kernel. In a run in mid October, it found 2,300 candidate bugs, reproduced 1,700 of them, and produced 948 working local privilege escalation exploits against a stock desktop Linux distribution, for about $1.2 million in API credits, or roughly $1,279 per root exploit. That\u2019s not cheap, but for comparison, Pwn2Own has historically paid $20,000 for a single Linux kernel privilege escalation. Local privilege escalation is the step after an attacker gets a foothold: turning an ordinary user account, a compromised web app, or a sandboxed process into full control of the machine. Coupled with even a basic vulnerability in other code, it can allow an attacker to take full control of the system and hide the compromise much more effectively.\nOpenAI says it\u2019s working with the kernel community to report the bugs and submit patches, starting with the most critical, and that during the ten days the scan was running, more than 100 other kernel privilege escalation bugs were patched by other contributors, with about 300 more being discussed publicly. The most sobering line in the report is that, for now, a low-privileged account on an unpatched system \u201cshould be considered functionally equivalent to root access for a well-resourced threat actor.\u201d It\u2019s been quite a week for kernel developers, and it\u2019s not going to slow down any time soon.\nThe flood of AI discovered vulnerabilities seems to continue unabated, and it\u2019s easy to feel under attack from them. Consider, however, how often the open source community has called for companies using open source tools and libraries as core elements of their business to help support those tools and community. There\u2019s still a significant burden placed on the community maintainers when almost 2000 bug reports land in a week, but over $1 million investment in securing Linux isn\u2019t nothing, and the patches at least appear to be reasonably scoped and accurate. I\u2019m pretty sure we\u2019d see an article covering Linus\u2019s response if they weren\u2019t.\nThe *sshole in musl\nPassword checking on Unix is simple in principle. Each account has a password hash stored in \u201c/etc/shadow\u201d; when you log in, the system hashes what you typed with the same salt and checks whether the result matches. Accounts which should never accept a password, like a key-only deploy user or root on many cloud images, get a \u201c\u201d instead of a hash, and since \u201c\u201d isn\u2019t a valid hash, nothing can ever match it. That convention goes back to BSD in 1980.\nThe sshole write-up explains how three reasonable decisions years apart added up to OpenSSH on musl libc (the smaller, lighter C library used by Alpine, OpenWrt, Buildroot, Yocto, and a lot of Docker images) accepting any password between 257 and 1024 characters for those \u201c\u201d accounts. In 2012, musl changed its \u201ccrypt()\u201d function to return \u201c\u201d instead of NULL when hashing fails, so careless programs wouldn\u2019t crash. Weeks later, musl capped SHA-512 password hashing at 256 bytes, since very long passwords can tie up the CPU, so anything longer fails. Then in 2016, to fix a timing bug (CVE-2016-6210) which let attackers tell real accounts from fake ones, sshd started hashing the password against another account\u2019s salt when an account has no real hash, just to take the same amount of time. Put it all together: a too-long password makes \u201ccrypt()\u201d fail, it returns \u201c\u201c, and \u201c\u201d matches the \u201c*\u201d stored for the locked account.\nYou\u2019re affected if sshd runs on musl without PAM (Alpine\u2019s default), password logins are enabled (also the default), there\u2019s an account locked with \u201c\u201c, and at least one other account has a real password for sshd to borrow the salt from. Alpine switched root to \u201c\u201d in 2022 after a previous fix for its passwordless Docker root (CVE-2019-5021), and on Alpine\u2019s official AWS and Azure images, the default \u201calpine\u201d user is locked this way and has passwordless \u201cdoas\u201d, so this is root. Systems using glibc, PAM, Dropbear, or OpenBSD aren\u2019t affected.\nThe researcher found it by building sshd every way they could think of and throwing about 17,600 unusual logins at each build with \u201cagent swarms\u201d; every build agreed except musl without PAM. OpenSSH 10.6p2 fixes it. If you can\u2019t update right away, set \u201cPasswordAuthentication no\u201d, which you probably wanted anyhow\u2026 Just make sure you provisioned SSH keys and tested them, first!\nClaude Code extension trojanized\nOn October 29, a malicious version (2.1.313) of Anthropic\u2019s official Claude Code extension for VS Code was distributed through the Cursor editor\u2019s extension marketplace. The malicious version was published under the official extension ID rather than as a lookalike, so anyone with auto-updates turned on simply received it. The Hacker News reports that Cursor says at most 5,000 users installed it during the roughly eleven hours it was available, and that the malicious version was not developed by Anthropic. How the attacker got their code into the marketplace hasn\u2019t been explained.\nAccording to the analysis by OpenSourceMalware, the extension was identical to the real one except for a 66-line loader added to the start of the main JavaScript file. As soon as the extension loads, it adds an attacker-controlled key labeled \u201csvc-telemetry\u201d to \u201c~/.ssh/authorized_keys\u201d, tries to turn on the local SSH server, opens a reverse SSH tunnel back to the attacker, installs persistence (a LaunchAgent disguised as \u201ccom.apple.sysmond\u201d on macOS, a crontab entry on Linux, and a scheduled task on Windows), and reports the host name, user, Git email address, and the names of any environment variables that look like credentials.\nPhorion found a bug in the macOS version of the attack: the malware checks if Remote Login is turned off by running a command which requires administrator rights, gets an error message back instead of \u201cOff\u201d, and assumes SSH is already running. On Macs without SSH turned on, the tunnel connects but leads nowhere. That\u2019s not something to count on, of course. If you used Claude Code in Cursor around October 29, check your authorized_keys file for the \u201csvc-telemetry\u201d key, look for the persistence entries, and rotate any credentials that machine could access. Version 2.1.314 is the clean replacement.\nOn a related note about developer tools reaching into each other, a Postman user filed a bug after discovering that opening the Postman desktop app had silently installed a Postman plugin for Claude Code, a startup instruction hook for their coding agents, a remote MCP connection, and the Postman CLI. As they put it, \u201cAn API client should not make itself the default workflow in other tools simply because I opened it.\u201d AI coding agents are rapidly becoming one of the most privileged pieces of software on a developer\u2019s machine, and everything with access to their configuration effectively gets to tell them what to do. Since the post, the company behind Postman has updated their website to note that the install will install other tools as well. Feels like the bad days of the early 2000s when every application also brought half a dozen desktop \u201cenhancements\u201d and browser toolbars.\nThe biggest crypto heist yet\nOn October 29, attackers stole $6.3 billion in cryptocurrency from Binance, the world\u2019s largest cryptocurrency exchange, which by a wide margin makes it the largest crypto theft ever. According to the AP, the FBI has attributed the attack to TraderTraitor, the North Korean group behind last year\u2019s $1.5 billion theft from Bybit, and is asking exchanges and blockchain analytics firms to block transactions linked to the stolen funds. Binance says it has enough reserves to cover 90% of the missing assets, and has promised customers will be fully reimbursed.\nBinance\u2019s initial findings, reported by the BBC, say the attackers compromised the computers of Binance engineers and gained control of the tools needed to drain its wallets. One engineer was contacted through a legitimate job-hunting platform and invited to fake job interviews with fake company representatives, who built trust by sharing social media accounts with personal photos. The attackers also used a compromised internal AI tool.\nFake job offers have been a favorite North Korean tactic for years, because \u201cplease run this coding test\u201d or \u201cplease install our interview software\u201d is a very natural way to get malware onto a developer\u2019s machine. If a recruiter you\u2019ve never heard of has an amazing opportunity and just needs you to run something, use a throwaway machine, or better yet, don\u2019t. If this sounds familiar, it\u2019s because Iranian hackers have already been known to pose as recruiters with booby-trapped coding tests, and similar lures are how recent high-profile supply chain compromises were triggered.\nPolymarket drained through a performance monitor\nPolymarket, the prediction market site, had user wallets drained on October 29 through a script it didn\u2019t write. Ohey has published a detailed analysis showing that the real-user monitoring script Polymarket loaded from DebugBear, a script to monitor users actions in the browser to track behavior and performance of website components, was replaced with a wallet drainer for about an hour. Around 16:54 UTC the script\u2019s normal origin server stopped responding, and shortly after, a different server started answering for DebugBear\u2019s hostnames and serving the malicious version.\nThe drainer was written specifically for Polymarket. It used Polymarket\u2019s own trading client from the page, signed transfers with each account\u2019s existing signer, and submitted them through Polymarket\u2019s own relayer. Every host it contacted, except for DebugBear, was already on Polymarket\u2019s Content Security Policy (the browser-enforced list of what a page is allowed to load and talk to), so nothing looked out of place. Polymarket removed the script at 17:59 UTC, paused trading, and says affected users will be reimbursed.\nThat\u2019s about $2.5 million in under an hour.\nAny third-party JavaScript a site loads runs with full access to the page, including whatever the logged-in user can do. We\u2019ve seen this before with the Polyfill.io takeover in 2024 and with Magecart credit card skimmers before that. A performance monitoring script is about the last thing anyone would think of as security-critical, which is exactly what makes it a good target.\nPoker cheating with remote access malware\nPolymarket isn\u2019t the only highly targeted supply chain attack this week. WIRED has a great story about a professional online poker player whose Claude agent, while helping review his play statistics, noticed MeshAgent, a legitimate open-source remote management tool, running on his computer. It had been installed months earlier without his knowledge, and had been capturing his screen during sessions on the Americas Cardroom site. The same opponent had been at his table for 10 of the 11 recorded sessions.\nThe attacker had compromised two popular multi-tabling tools used by high-stakes players, Jurojin and IntuitiveTables. Jurojin was compromised through its own update system, and the IntuitiveTables developer\u2019s test machine was infected through that Jurojin update, letting the attacker add malicious code before the developer signed the next release. The trojanized software checked the user\u2019s poker usernames against a list of high-stakes targets, and only installed the remote access agent for players on the list; everyone else got a perfectly normal app. Sources estimate the attacker took between $1.5 million and $4 million.\nThe sites\u2019 responses have varied wildly. CoinPoker banned the player in 2025 and refunded more than $100,000, while players say reports to GGPoker and ACR went unanswered for months. GGPoker has since banned third-party tools and added anomaly detection, while ACR has announced it found no wrongdoing and won\u2019t issue refunds, in the same email announcing a new feature to stop remote tools from capturing card images.\nSupermarket freezers, again, again\nIt\u2019s a three-peat!\nLast month we covered refrigeration controllers in hundreds of French supermarkets being hijacked and set to heat instead of cool. On Monday, the Guardian reports, retailers in at least seven more countries (Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, and Sweden) found their refrigerators and freezers heated to as high as 50C (122F) overnight. Affected chains include Ahold Delhaize, Carrefour Belgium, Coop and ICA in Sweden, SuperValu in Ireland, and an Ikea store in Belgium.\nThe operator of Delhaize\u2019s refrigeration systems said the units\u2019 evaporators were switched into defrost mode, the same defrost-mode trick seen in the US military commissary failures earlier this fall. The head of Sweden\u2019s national cybersecurity centre said the country had \u201cquite a lot of exposed operational technology devices\u201d that needed patching, and Patrick Lamplmair of the security firm Tributech said \u201cthousands of these controllers were still reachable from the internet after the French attack.\u201d Nobody has claimed responsibility, and there have been no ransom demands, which points toward sabotage rather than profit.\nIf there is any lesson to take from the past two months, it\u2019s that refrigeration controllers, building management systems, and other industrial gear have no business being directly reachable from the Internet. Put them behind a VPN, or at the very least behind a firewall that only allows the monitoring service to connect.\nFake nuclear alerts in Ukraine and Russia\nOn Sunday night, users of Ukraine\u2019s \u201cAir Alert\u201d app, which millions of people rely on to warn them of incoming missiles and drones, received a series of fake warnings about radiation, chemical threats, and street fighting, followed by a message in Russian claiming all of Ukraine was under nuclear alert. NBC News reports that some public warning sirens and loudspeakers in the Lviv region also broadcast a radiation hazard signal. Hours later, Russia\u2019s emergencies ministry said its own alert app had suffered a \u201cmassive cyberattack\u201d and sent fake warnings of nuclear warheads launched at Russia.\nUkrainian president Zelenskyy then confirmed to PBS that the Russian alerts were Ukraine\u2019s retaliation: \u201cWe only respond on their attacks.\u201d\nMany Ukrainians apparently shrugged the alerts off as an obvious fake, partly because they were in Russian. But emergency alerts only work if people trust them: Hawaii\u2019s accidental missile alert in 2018 showed how much damage a single false alarm can do, and alert systems which can be spoofed teach people to ignore the real ones. It\u2019s nuisance-level hacking with potentially drastic real-world consequences.\nResidential proxies, from set-top boxes to the White House\nResidential proxy services, which we\u2019ve talked about a lot in the past few months, sell access to other people\u2019s internet connections, so traffic appears to come from an ordinary home or business. If you\u2019re lucky, it\u2019s only being used for ad fraud. If you\u2019re unlucky, it\u2019s redirecting \u201cfree\u201d VPN traffic through your home IP, being used to hack companies from a less-suspicious domestic IP address, or sold to a ransomware group to attack systems inside your network. The devices providing those connections are usually running a proxy SDK bundled with some \u201cfree\u201d app or game, or are cheap gadgets with the proxy software built in: This week brought examples of both ends of that pipeline.\nGoogle has dismantled the XCPE botnet, more than 1.3 million Android set-top boxes, and says with high confidence that the backdoor was built and operated by the device manufacturer itself, Videostrong Technology. The backdoor ran with system privileges and reinstalled itself from a protected partition if removed. Videostrong sold access to affiliates, loading their modules for ad fraud, residential proxy networks (including Linkfog, AppSalt, and NetNut), and yet more malware, and Google says it saw Videostrong operators capturing screens, injecting keystrokes, and opening reverse shells on devices. Back in August we looked at a teardown of a cheap streaming box which turned out to be pre-infected; this is the business model behind that kind of device. Surprisingly, Videostrong was an official Google manufacturing partner who went through the certification process, making them much more legitimate than many of the cheap devices out there. Google has since banned Videostrong from making certified Android devices, and changed its certification process, the malware was loaded after first boot specifically to slip past Google\u2019s testing.\nAt the other end, Layer3 Intel reports that its probes through public residential proxy services exited from the White House network (AS2650, registered to the Executive Office of the President) 236 times between October 5 and November 3, from six different addresses, through 28 different proxy services. As Brian Krebs reports, the proxy tracking firm Synthient tied the activity to Windows 11 installations of Infatica, whose founder previously ran King Servers, the hosting company used by Russian state hackers to attack election systems in Arizona and Illinois in 2016. Most of the activity happens between 5pm and midnight, suggesting a person\u2019s device rather than a guest network. Synthient\u2019s founder Ben Brundage told Krebs that some resellers charge as little as 60 cents a gigabyte, so \u201cfor less than a dollar you can gain access into some of the most confidential and trusted networks.\u201d\nBeing an exit node doesn\u2019t automatically mean the internal network is exposed, but past research has shown that poorly secured proxy SDKs can be used to reach other devices on the local network. If you have an off-brand Android TV box which seemed like a suspiciously good deal, it might be time to retire it, or at least move it to its own isolated network.\nNever gonna print you up\nOver a week in August, Yannick Dixken took apart the firmware on his Prusa MK4S, and came away with 14 findings covering roughly 23 individual bugs, ending in code execution on the printer\u2019s main controller over the network. Prusa has fixed all of them in Buddy firmware 7.0.0, which covers fifteen printer models across the CORE One, XL, MK4, MK3.5/3.9, and MINI lines. If you have one, update it.\nThe worst bug is in the code that handles commands from Prusa Connect, Prusa\u2019s cloud (or self-hosted) printer management service. A file path from Connect is copied into a shared 512-byte buffer, with the filename written right after it, and the only thing enforcing the 104-byte path limit is an \u201cassert()\u201d call. Asserts are debugging checks which are typically compiled out of release builds, so in the shipping firmware a long path overflows the buffer onto a pointer used to dispatch printer commands. The firmware also had no stack canaries, a common compiler protection against exactly this kind of overflow. To exploit it, an attacker has to control or intercept the Connect endpoint the printer talks to; Dixken tested with TLS turned off, so a real attack would need to defeat or downgrade TLS as well. Other findings include crafted USB filenames which also take control of the processor, and encrypted Connect downloads with no integrity checking.\nDixken used Claude Opus and a fuzzer, along with a Cortex-M emulator running the real signed firmware, and credits the tools with making this kind of thoroughness cheap. He also has kind words for Prusa, which answered within a day, reproduced the bugs, and coordinated disclosure, unlike a previous vendor which answered him with a law firm. As he puts it, \u201cOnly one of those two responses makes the next researcher pick up the phone.\u201d Not everything has gone smoothly: Prusa held back the 7.0.0 source code until the disclosure, to give owners time to update, which has kicked off a heated discussion about the GPL obligations of firmware derived from Marlin.\nGitLab regex bug hits Alpine\nIt\u2019s been a rough week for Alpine. Two weeks ago we mentioned CVE-2026-97229, a CVSS 10.0 bug in GitLab\u2019s handling of regular expressions in CI configurations. Alpine Linux has published an incident report describing how an attacker tried to exploit it against Alpine\u2019s own GitLab instance on October 20 and 21, a week after the fix was released.\nAlpine had accidentally upgraded to the version just before the fix. Worse, when they upgraded to a fixed version on October 22, they were still vulnerable: the actual bug is in Onigmo, the regular expression engine built into Ruby, and GitLab\u2019s fix is a patch to the copy of Ruby that ships in GitLab\u2019s own packages. Alpine runs GitLab on a standard Ruby, so the update did nothing until upstream Ruby shipped its own fix on October 23. The attacker crashed GitLab worker processes eight times, got partway through the exploit four times, and even downloaded Alpine\u2019s GitLab container image, presumably to tune the exploit for their exact build.\nAlpine found no evidence the attack succeeded, but couldn\u2019t rule it out, so it rebuilt the server from scratch, reset every password, and verified every commit and package against its 45 build servers. Package signing keys were never stored on the GitLab server. It\u2019s a good, transparent write-up, and the lesson applies to anyone running GitLab from source or a custom container: upgrading GitLab isn\u2019t enough, you also need Ruby 3.3.13, 3.4.12, 4.0.9, or later.\nFollow-ups: PHP2Shell and eMudhra\nLast week we noted that, despite all the chaos around the broken PHP2Shell embargo, nobody had been able to show a reliable exploit. Wordfence\u2019s latest update says that, as of October 28, it still isn\u2019t aware of any WordPress site compromised through PHP2Shell, despite logging about 77,600 attack requests from more than 2,000 IP addresses. That doesn\u2019t mean nothing has happened: security firm Dream reported an attacker using a customized PHP2Shell exploit plus a Linux kernel privilege escalation to take over 24 internet-facing firewalls, Palo Alto Networks reports active exploitation targeting PAN-OS management interfaces, and Morphisec reported code execution on a Windows IIS server. Working exploits apparently need to be tuned to each target, and as we keep seeing, \u201chard to exploit\u201d buys time, not safety. If practical exploitation requires tight timing, expect attackers to focus on products which embed PHP on hardware with predictable timing (like Palo Alto and other solutions-in-a-box) more than random servers, but you\u2019re still not safe if you haven\u2019t updated!\nThe trivially recoverable eMudhra certificate authority keys have also found a new use. Alexandro Sanchez has shown that they can be used to bypass Android\u2019s Factory Reset Protection, the anti-theft feature which requires the previous owner\u2019s Google account after a phone is wiped, so a stolen phone can\u2019t simply be reset and resold. Using one of the compromised intermediate certificates to impersonate Google\u2019s servers during the setup wizard, Sanchez injects a response that marks the phone as already set up, then combines that with an older vulnerability to wipe the FRP lock; he\u2019s keeping the full chain private. The compromised intermediates have been revoked and blocked by the major browsers, but they don\u2019t expire until 2028 or 2040, and anything which doesn\u2019t check revocation or get a trust store update will keep trusting them. Apparently that includes at least part of the Android setup process.\nAPT redirects and resumed downloads\nDebian has released a security update for APT, the package manager used by Debian, Ubuntu, Raspberry Pi OS, and many others. Max Justicz found that if an HTTP redirect makes two different package downloads end up at the same URI, APT can merge them, and a flaw in how it resumes interrupted downloads lets an attacker in the middle of the connection replace a package after it has been verified. The result is arbitrary code execution as root.\nMany APT mirrors still use plain HTTP, which is normally fine: the package lists are cryptographically signed and every package is checked against them, so tampering in transit should be caught. Bugs like this break that assumption. Justicz also found the last big APT redirect bug, CVE-2019-3462, back in 2019. Update APT, and consider switching your mirrors to HTTPS if they support it.\nSecure USB sticks, or not\nSecurity researcher Xusheng Li of Vector 35 found that Lenovo\u2019s ThinkPlus FU100 fingerprint USB stick, sold as an AES-256 encrypted drive, is in fact a plain SD card in a fancy case, Tom\u2019s Hardware reports. The fingerprint reader only turns the USB connection on; nothing is encrypted. Lenovo\u2019s TSD303 SSD did encrypt its data, but sent the correct password back over USB in plain text so the software could compare it. Lenovo says the products were sold only in China, that it fixed them and published CVE-2025-13453, CVE-2025-13454, and CVE-2025-13455 in January, and that owners can contact support for a replacement.\nIn a follow-up covered in his slides, Li used OpenAI\u2019s Codex with his company\u2019s reverse engineering tools to look at other vendors\u2019 \u201csecure\u201d USB products, finding fixed keys built into software from Netac, KakaSoft, and Nexcopy in minutes, and two hidden backdoor accounts in another product. His summary is hard to improve on: \u201c\u2018Hardware security\u2019 can be pure marketing.\u201d\nSecure, \u201csecure\u201d, or just a standard USB drive, you still need to know where your USB stick of data is. Politico reports that the UK\u2019s oversight body for surveillance found GCHQ, Britain\u2019s signals intelligence agency, can\u2019t account for \u201cthousands\u201d of USB sticks, hard drives, and memory cards which may hold intercepted communications. The Investigatory Powers Commissioner said GCHQ \u201cstill cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them.\u201d Hopefully they at least bought the kind which actually encrypts. \nhackaday.com/2026/11/06/this-w\u2026RE: infosec.exchange/users/malware\u2026", "url": "https://poliverso.org/objects/0477a01e-d1a6c9e6-8e63099de9f75bce"}, {"timestamp": "2026-11-06T19:02:23Z", "date_only": false, "value": "2026-11-06T19:02:23.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109386", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "0ebbe472-dea1-431e-820f-0472c18ade78", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-97229-gitlab-ci-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ghost-Bx1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-06 18:36:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-97229 - GitLab CE/EE CI/CD Integer Overflow RCE | CVSS 10.0 | By Gh0st-Bx1\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109386", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-07T04:49:37.998Z", "date_only": false, "value": "2026-11-07T04:49:37.998781Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hey-kira.bsky.social/post/3mzp3uelkrd2k", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "fbf0f679-7d24-40ea-a8db-6ece1f295a93", "content": "A live case with that shape: GitLab's out-of-band patches for CVE-2026-97229 landed 12 Oct - 19.4.2, 19.3.5, 19.2.8. Reporting on Shadowserver data still counted over 1,000 unpatched internet-exposed instances afterwards, exploitation observed. The patch shipping is not the fix landing.", "url": "https://bsky.app/profile/hey-kira.bsky.social/post/3mzp3uelkrd2k"}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.revision_history.5.date", "linked_record": true}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4416", "record": "WID-SEC-W-2026-4416", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4416", "record": "WID-SEC-W-2026-4416", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4416", "record": "WID-SEC-W-2026-4416", "field": "vulnerabilities.2.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_almalinux \u00b7 ALSA-2026:96067", "record": "ALSA-2026:96067", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_almalinux \u00b7 ALSA-2026:96068", "record": "ALSA-2026:96068", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_almalinux \u00b7 ALSA-2026:96120", "record": "ALSA-2026:96120", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_almalinux \u00b7 ALSA-2026:96233", "record": "ALSA-2026:96233", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_almalinux \u00b7 ALSA-2026:96235", "record": "ALSA-2026:96235", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T02:29:22Z", "date_only": false, "value": "2026-11-09T02:29:22+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:96067", "record": "RHSA-2026:96067", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-09T02:29:22Z", "date_only": false, "value": "2026-11-09T02:29:22+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:96067", "record": "RHSA-2026:96067", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T02:29:22Z", "date_only": false, "value": "2026-11-09T02:29:22+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:96067", "record": "RHSA-2026:96067", "field": "vulnerabilities.2.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T04:41:51Z", "date_only": false, "value": "2026-11-09T04:41:51+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:96068", "record": "RHSA-2026:96068", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-09T04:41:51Z", "date_only": false, "value": "2026-11-09T04:41:51+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:96068", "record": "RHSA-2026:96068", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T04:41:51Z", "date_only": false, "value": "2026-11-09T04:41:51+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:96068", "record": "RHSA-2026:96068", "field": "vulnerabilities.2.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T05:17:01Z", "date_only": false, "value": "2026-11-09T05:17:01+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:96120", "record": "RHSA-2026:96120", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-09T05:17:01Z", "date_only": false, "value": "2026-11-09T05:17:01+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:96120", "record": "RHSA-2026:96120", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T05:17:01Z", "date_only": false, "value": "2026-11-09T05:17:01+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:96120", "record": "RHSA-2026:96120", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T11:31:06Z", "date_only": false, "value": "2026-11-09T11:31:06+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:96233", "record": "RHSA-2026:96233", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-09T11:31:06Z", "date_only": false, "value": "2026-11-09T11:31:06+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:96233", "record": "RHSA-2026:96233", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T11:31:06Z", "date_only": false, "value": "2026-11-09T11:31:06+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:96233", "record": "RHSA-2026:96233", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T12:04:41.930Z", "date_only": false, "value": "2026-11-09T12:04:41.930864Z", "kind": "milestone", "label": "Published", "source": "osv_rocky \u00b7 RLSA-2026:96068", "record": "RLSA-2026:96068", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T12:04:41.930Z", "date_only": false, "value": "2026-11-09T12:04:41.930864Z", "kind": "milestone", "label": "Published", "source": "osv_rocky \u00b7 RLSA-2026:96120", "record": "RLSA-2026:96120", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T12:13:35Z", "date_only": false, "value": "2026-11-09T12:13:35Z", "kind": "other", "label": "Updated", "source": "osv_almalinux \u00b7 ALSA-2026:96120", "record": "ALSA-2026:96120", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-09T12:13:39Z", "date_only": false, "value": "2026-11-09T12:13:39Z", "kind": "other", "label": "Updated", "source": "osv_almalinux \u00b7 ALSA-2026:96068", "record": "ALSA-2026:96068", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-09T12:46:50Z", "date_only": false, "value": "2026-11-09T12:46:50+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:96235", "record": "RHSA-2026:96235", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-09T12:46:50Z", "date_only": false, "value": "2026-11-09T12:46:50+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:96235", "record": "RHSA-2026:96235", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T12:46:50Z", "date_only": false, "value": "2026-11-09T12:46:50+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:96235", "record": "RHSA-2026:96235", "field": "vulnerabilities.2.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T12:47:28Z", "date_only": false, "value": "2026-11-09T12:47:28+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-09T12:47:28Z", "date_only": false, "value": "2026-11-09T12:47:28+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-09T12:47:28Z", "date_only": false, "value": "2026-11-09T12:47:28+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-09T12:47:29Z", "date_only": false, "value": "2026-11-09T12:47:29+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-09T12:47:29Z", "date_only": false, "value": "2026-11-09T12:47:29+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-09T12:47:29Z", "date_only": false, "value": "2026-11-09T12:47:29+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:88880", "record": "RHSA-2026:88880", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-09T12:47:34Z", "date_only": false, "value": "2026-11-09T12:47:34+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-09T12:47:34Z", "date_only": false, "value": "2026-11-09T12:47:34+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-09T12:47:34Z", "date_only": false, "value": "2026-11-09T12:47:34+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:88865", "record": "RHSA-2026:88865", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-09T13:24:09Z", "date_only": false, "value": "2026-11-09T13:24:09Z", "kind": "other", "label": "Updated", "source": "osv_almalinux \u00b7 ALSA-2026:96067", "record": "ALSA-2026:96067", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-09T13:28:19.885Z", "date_only": false, "value": "2026-11-09T13:28:19.885925Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3mzuzroidtc2b", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "2af02a06-2315-41a8-b887-feefc53e2389", "content": "CVE-2026-97229 (CVSS 10) lets an attacker run code on self-managed GitLab. Our network has seen 102 IPs probing for it since Nov 4, and Alpine Linux found that upgrading GitLab alone wasn't enough: Ruby needs patching too.\n#infosec #GitLab", "url": "https://bsky.app/profile/crowdsec.bsky.social/post/3mzuzroidtc2b"}, {"timestamp": "2026-11-09T14:43:33Z", "date_only": false, "value": "2026-11-09T14:43:33Z", "kind": "other", "label": "Updated", "source": "osv_almalinux \u00b7 ALSA-2026:96233", "record": "ALSA-2026:96233", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-09T16:42:57Z", "date_only": false, "value": "2026-11-09T16:42:57+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:96067", "record": "RHSA-2026:96067", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-09T16:42:57Z", "date_only": false, "value": "2026-11-09T16:42:57+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:96233", "record": "RHSA-2026:96233", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-09T16:42:57Z", "date_only": false, "value": "2026-11-09T16:42:57+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:96067", "record": "RHSA-2026:96067", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-09T16:42:57Z", "date_only": false, "value": "2026-11-09T16:42:57+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:96233", "record": "RHSA-2026:96233", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-09T16:42:57Z", "date_only": false, "value": "2026-11-09T16:42:57+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:96067", "record": "RHSA-2026:96067", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-09T16:42:57Z", "date_only": false, "value": "2026-11-09T16:42:57+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:96233", "record": "RHSA-2026:96233", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-09T16:42:58Z", "date_only": false, "value": "2026-11-09T16:42:58+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:96068", "record": "RHSA-2026:96068", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-09T16:42:58Z", "date_only": false, "value": "2026-11-09T16:42:58+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:96235", "record": "RHSA-2026:96235", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-09T16:42:58Z", "date_only": false, "value": "2026-11-09T16:42:58+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:96068", "record": "RHSA-2026:96068", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-09T16:42:58Z", "date_only": false, "value": "2026-11-09T16:42:58+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:96235", "record": "RHSA-2026:96235", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-09T16:42:58Z", "date_only": false, "value": "2026-11-09T16:42:58+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:96068", "record": "RHSA-2026:96068", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-09T16:42:58Z", "date_only": false, "value": "2026-11-09T16:42:58+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:96235", "record": "RHSA-2026:96235", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-09T16:43:00Z", "date_only": false, "value": "2026-11-09T16:43:00+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:96120", "record": "RHSA-2026:96120", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-09T16:43:00Z", "date_only": false, "value": "2026-11-09T16:43:00+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:96120", "record": "RHSA-2026:96120", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-09T16:43:00Z", "date_only": false, "value": "2026-11-09T16:43:00+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:96120", "record": "RHSA-2026:96120", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.revision_history.6.date", "linked_record": true}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4416", "record": "WID-SEC-W-2026-4416", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4416", "record": "WID-SEC-W-2026-4416", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-09T23:29:03.146Z", "date_only": false, "value": "2026-11-09T23:29:03.146612Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/saisosiouxme.bsky.social/post/3mzw3dca34s23", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ee89105b-1371-4079-8f46-23f2c6f398f9", "content": "CVE-2026-97229 is a CVSS 10.0 flaw that lets an outsider run their own code on self-managed GitLab servers running versions 19.2 to 19.4. Servers that let anyone create an account are the easy targets. CrowdSec has observed 102 unique IP addresses sending matching requests since Nov 4th", "url": "https://bsky.app/profile/saisosiouxme.bsky.social/post/3mzw3dca34s23"}, {"timestamp": "2026-11-10T08:29:16Z", "date_only": false, "value": "2026-11-10T08:29:16+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-10T08:29:16Z", "date_only": false, "value": "2026-11-10T08:29:16+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-10T08:29:16Z", "date_only": false, "value": "2026-11-10T08:29:16+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:95652", "record": "RHSA-2026:95652", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-10T08:55:22Z", "date_only": false, "value": "2026-11-10T08:55:22Z", "kind": "other", "label": "Updated", "source": "osv_almalinux \u00b7 ALSA-2026:96235", "record": "ALSA-2026:96235", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T09:57:04.937Z", "date_only": false, "value": "2026-11-10T09:57:04.937+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4416", "record": "WID-SEC-W-2026-4416", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-10T10:12:54.101Z", "date_only": false, "value": "2026-11-10T10:12:54.101+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-10T12:04:52.928Z", "date_only": false, "value": "2026-11-10T12:04:52.928049Z", "kind": "milestone", "label": "Published", "source": "osv_rocky \u00b7 RLSA-2026:96067", "record": "RLSA-2026:96067", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T12:09:45.660Z", "date_only": false, "value": "2026-11-10T12:09:45.660151Z", "kind": "milestone", "label": "Published", "source": "osv_rocky \u00b7 RLSA-2026:96233", "record": "RLSA-2026:96233", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T12:09:45.660Z", "date_only": false, "value": "2026-11-10T12:09:45.660151Z", "kind": "milestone", "label": "Published", "source": "osv_rocky \u00b7 RLSA-2026:96235", "record": "RLSA-2026:96235", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T19:30:08.224Z", "date_only": false, "value": "2026-11-10T19:30:08.224207Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mzy6hl55fo2f", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "eb57b616-484c-49e9-bea3-dc7be5e616f6", "content": "\ud83d\udce2 [VULN] GitLab, deux failles not\u00e9es 10 en neuf jours et des serveurs autog\u00e9r\u00e9s attaqu\u00e9s trois semaines apr\u00e8s le correctif - CVE-2026-97229\n\nUne faille de GitLab not\u00e9e 10 sur 10, corrig\u00e9e le 12 octobre, est exploit\u00e9e en nombre depuis le 4 novembre sur les serveurs que les entrepr\u2026\n\n#CVE #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mzy6hl55fo2f"}, {"timestamp": "2026-11-11T06:28:08.292Z", "date_only": false, "value": "2026-11-11T06:28:08.292948Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mzzda7eca22b", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "ef24fcdc-f809-441d-bfc5-e42e7c9d97fe", "content": "\ud83c\udf0d \u00c0 l\u2019international (suite)\n\u2022 GitLab : Deux vuln\u00e9rabilit\u00e9s critiques (CVE-2026-97229) not\u00e9es 10/10 sont exploit\u00e9es activement sur des serveurs autog\u00e9r\u00e9s, malgr\u00e9 des correctifs publi\u00e9s il y a neuf jours. (Cyberveille)", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mzzda7eca22b"}, {"timestamp": "2026-11-12T10:46:11Z", "date_only": false, "value": "2026-11-12T10:46:11+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-12T10:46:11Z", "date_only": false, "value": "2026-11-12T10:46:11+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-12T10:46:11Z", "date_only": false, "value": "2026-11-12T10:46:11+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:95657", "record": "RHSA-2026:95657", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-12T10:46:13Z", "date_only": false, "value": "2026-11-12T10:46:13+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-12T10:46:13Z", "date_only": false, "value": "2026-11-12T10:46:13+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-12T10:46:13Z", "date_only": false, "value": "2026-11-12T10:46:13+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:95655", "record": "RHSA-2026:95655", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-12T10:46:17Z", "date_only": false, "value": "2026-11-12T10:46:17+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-12T10:46:17Z", "date_only": false, "value": "2026-11-12T10:46:17+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-12T10:46:17Z", "date_only": false, "value": "2026-11-12T10:46:17+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:95656", "record": "RHSA-2026:95656", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-12T12:14:01.132Z", "date_only": false, "value": "2026-11-12T12:14:01.132164Z", "kind": "other", "label": "Updated", "source": "osv_rocky \u00b7 RLSA-2026:96067", "record": "RLSA-2026:96067", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-12T12:14:01.482Z", "date_only": false, "value": "2026-11-12T12:14:01.482428Z", "kind": "other", "label": "Updated", "source": "osv_rocky \u00b7 RLSA-2026:96068", "record": "RLSA-2026:96068", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-12T12:14:01.843Z", "date_only": false, "value": "2026-11-12T12:14:01.843073Z", "kind": "other", "label": "Updated", "source": "osv_rocky \u00b7 RLSA-2026:96120", "record": "RLSA-2026:96120", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-12T12:14:05.923Z", "date_only": false, "value": "2026-11-12T12:14:05.923984Z", "kind": "other", "label": "Updated", "source": "osv_rocky \u00b7 RLSA-2026:96233", "record": "RLSA-2026:96233", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-12T12:14:06.045Z", "date_only": false, "value": "2026-11-12T12:14:06.045624Z", "kind": "other", "label": "Updated", "source": "osv_rocky \u00b7 RLSA-2026:96235", "record": "RLSA-2026:96235", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-12T13:22:06.370Z", "date_only": false, "value": "2026-11-12T13:22:06.370462Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3n24ktdx6dc24", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "feb2c778-3df8-46be-af50-b201f0fe948c", "content": "\u300cGitLab\u300d\u304c\u300c\u30af\u30ea\u30c6\u30a3\u30ab\u30eb\u300d\u8106\u5f31\u6027\u542b\u308024\u4ef6\u306e\u4fee\u6b63\u3092\u5b9f\u65bd\n\nGitLab\u306f\u73fe\u5730\u6642\u95932026\u5e7410\u67088\u65e5\u3001\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u958b\u767a\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u300cGitLab\u300d\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u3002\u300c\u30af\u30ea\u30c6\u30a3\u30ab\u30eb\u300d\u3068\u3055\u308c\u308b\u8106\u5f31\u6027\u306a\u3069\u3082\u4fee\u6b63\u306b\u542b\u307e\u308c\u3066\u304a\u308a\u3001\u3059\u307f\u3084\u304b\u306b\u66f4\u65b0\u3059\u308b\u3088\u3046\u6c42\u3081\u3066\u3044\u308b\u3002\n\n...\n\n\u300cCVE-2026-97229\u300d\u306f\u3001CI/CD\u8a2d\u5b9a\u306b\u542b\u307e\u308c\u308b\u6b63\u898f\u8868\u73fe\u306e\u51e6\u7406\u306b\u8d77\u56e0\u3059\u308b\u6574\u6570\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u8106\u5f31\u6027\u3002\u6b63\u898f\u8868\u73fe\u306e\u691c\u8a3c\u304c\u4e0d\u5341\u5206\u3067\u3001\u7279\u5b9a\u306e\u6761\u4ef6\u4e0b\u3067\u7d30\u5de5\u3057\u305f\u6b63\u898f\u8868\u73fe\u3092\u901a\u3058\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u8005\u304cGitLab\u30b5\u30fc\u30d0\u4e0a\u3067\u4efb\u610f\u306e\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u308b\u304a\u305d\u308c\u304c\u3042\u308b\u3002", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3n24ktdx6dc24"}, {"timestamp": "2026-11-12T17:56:43.622Z", "date_only": false, "value": "2026-11-12T17:56:43.622409Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tellerstech.bsky.social/post/3n2526bviga2r", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "06ebb4c3-777a-4bfd-98de-49c159a6d552", "content": "GitLab CVE-2026-97229: Why Alpine's Upgrade Missed the Ruby Fix #gitlab #ruby #devops #sre\n\nThis is a clip from our recent Ship It Weekly Podcast episode.\nVisit shipitweekly.fm or link in bio to listen to the full episode!", "url": "https://bsky.app/profile/tellerstech.bsky.social/post/3n2526bviga2r"}, {"timestamp": "2026-11-12T20:03:01.968Z", "date_only": false, "value": "2026-11-12T20:03:01.968130Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3n25ba6squc2u", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "9a50cef7-9e0f-4499-8ccc-621f823741af", "content": "GitLab\u304c\u6700\u5927\u6df1\u523b\u5ea6\u306e\u8106\u5f31\u6027CVE-2026-97229\u3092\u4fee\u6b63\n\nGitLab\u306f\u3001\u653b\u6483\u8005\u304c\u30ed\u30b0\u30a4\u30f3\u305b\u305a\u306b\u30b5\u30fc\u30d0\u30fc\u4e0a\u3067\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u308b\u53ef\u80fd\u6027\u306e\u3042\u308b\u3001CVE-2026-97229\uff08CVSS\u30b9\u30b3\u30a210.0\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u91cd\u5927\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u6b20\u9665\u306b\u5bfe\u51e6\u3057\u307e\u3057\u305f\u3002\n\n\u3053\u306e\u8106\u5f31\u6027\u306f\u3001Community Edition (CE) \u3068 Enterprise Edition (EE) \u306b\u5f71\u97ff\u3057\u307e\u3059\u3002CI/CD \u69cb\u6210\u306b\u304a\u3051\u308b\u6b63\u898f\u8868\u73fe\u306e\u691c\u8a3c\u304c\u4e0d\u5341\u5206\u306a\u305f\u3081\u306b\u767a\u751f\u3059\u308b\u6574\u6570\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u30d0\u30b0\u3067\u3059\u3002\u3053\u306e\u554f\u984c\u306f\u3001GitLab \u30d0\u30fc\u30b8\u30e7\u30f3 19.2 (19.2.8 \u3088\u308a\u524d)\u300119.3 (19.3.5 \u3088\u308a...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3n25ba6squc2u"}], "metrics": {"as_of": "2026-11-13T00:37:23.368Z", "anchors": {"origin": {"timestamp": "2026-10-11T22:00:00Z", "date_only": false, "value": "2026-10-11T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.2.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-11T22:00:00Z", "date_only": false, "value": "2026-10-11T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": {"timestamp": "2026-10-13T09:00:08Z", "date_only": false, "value": "2026-10-13T09:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105131", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4ccd639d-e943-406f-8faa-2a161d8b8d2d", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AmpedWasTaken\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-13 08:51:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-97229 \u2014 GitLab CI/CD Regex Compiler RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105131", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-10-13T11:30:06Z", "date_only": false, "value": "2026-10-13T11:30:06.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8706", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a44aa140-2d24-4812-ad8d-08136940ba10", "content": "GitLab \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0440\u043e\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0432 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 CI/CD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u0445.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GitLab, \u0447\u0442\u043e \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u043e\u0439 DevSecOps \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 30 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0431\u043e\u043b\u0435\u0435 50% \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430 Fortune 100, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Nvidia, T-Mobile, Lockheed Martin, Airbus \u0438 Goldman Sachs.\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-97229 \u0438 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c joaxcar, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0432\u0435\u0434\u043e\u043c\u0438\u043b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0437\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 HackerOne \u043e\u0442 GitLab.\n\nCVE-2026-97229 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0432 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 GitLab CI/CD, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442, \u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u0443\u0435\u0442 \u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u044f\u0435\u0442 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432.\n\n\u041a\u0430\u043a \u043f\u043e\u044f\u0441\u043d\u044f\u0435\u0442 GitLab, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 CI/CD \u0438\u0437-\u0437\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439.\n\nGitLab \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 GitLab Community Edition (CE) \u0438 Enterprise Edition (EE) \u0441 19.2 \u0434\u043e 19.2.8, \u0441 19.3 \u0434\u043e 19.3.4 \u0438 \u0441 19.4 \u0434\u043e 19.4.2, \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0437\u0432\u0430\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u044b.\n\n\u041d\u0430 GitLab.com \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f. \u041a\u043b\u0438\u0435\u043d\u0442\u0430\u043c GitLab Dedicated \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043d\u0435 \u043d\u0443\u0436\u043d\u043e.\n\nCVE-2026-97229 - \u044d\u0442\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0438\u0437 \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 GitLab \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043c\u0435\u0441\u044f\u0446\u044b. \u0412 \u044f\u043d\u0432\u0430\u0440\u0435 \u0431\u044b\u0434\u043b\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0443\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u0433\u0440\u043e\u0437\u0443 \u043e\u0431\u0445\u043e\u0434\u0430 2Fa (CVE-2026-0723), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c, \u0437\u043d\u0430\u044e\u0449\u0438\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0436\u0435\u0440\u0442\u0432\u044b, \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Community Edition \u0438 Enterprise Edition.\n\n\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 \u043f\u043e\u0444\u0438\u043a\u0441\u0438\u043b\u0438 \u0435\u0449\u0435 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 (CVE-2026-85706) \u0432 GitLab CE/EE, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u044b, \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.\n\n\u041f\u043e\u0437\u0436\u0435 CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u043e CVE-2026-85706 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 KEV, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0438\u0433\u0443\u0440\u0438\u0440\u0443\u0435\u0442 \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 GitLab, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0434\u043d\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u043d\u0434\u0430\u043c\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439.", "url": "https://t.me/true_secator/8706", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "patch": {"timestamp": "2026-10-23T21:28:41Z", "date_only": false, "value": "2026-10-23T21:28:41+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.2.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 135006.0, "hours": 37.501666666666665, "days": 1.5625694444444445, "min_seconds": 135006.0, "max_seconds": 135006.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-11T22:00:00Z", "date_only": false, "value": "2026-10-11T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-10-13T11:30:06Z", "date_only": false, "value": "2026-10-13T11:30:06.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8706", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a44aa140-2d24-4812-ad8d-08136940ba10", "content": "GitLab \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0440\u043e\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0432 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 CI/CD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u0445.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GitLab, \u0447\u0442\u043e \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u043e\u0439 DevSecOps \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 30 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0431\u043e\u043b\u0435\u0435 50% \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430 Fortune 100, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Nvidia, T-Mobile, Lockheed Martin, Airbus \u0438 Goldman Sachs.\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-97229 \u0438 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c joaxcar, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0432\u0435\u0434\u043e\u043c\u0438\u043b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0437\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 HackerOne \u043e\u0442 GitLab.\n\nCVE-2026-97229 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0432 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 GitLab CI/CD, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442, \u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u0443\u0435\u0442 \u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u044f\u0435\u0442 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432.\n\n\u041a\u0430\u043a \u043f\u043e\u044f\u0441\u043d\u044f\u0435\u0442 GitLab, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 CI/CD \u0438\u0437-\u0437\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439.\n\nGitLab \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 GitLab Community Edition (CE) \u0438 Enterprise Edition (EE) \u0441 19.2 \u0434\u043e 19.2.8, \u0441 19.3 \u0434\u043e 19.3.4 \u0438 \u0441 19.4 \u0434\u043e 19.4.2, \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0437\u0432\u0430\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u044b.\n\n\u041d\u0430 GitLab.com \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f. \u041a\u043b\u0438\u0435\u043d\u0442\u0430\u043c GitLab Dedicated \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043d\u0435 \u043d\u0443\u0436\u043d\u043e.\n\nCVE-2026-97229 - \u044d\u0442\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0438\u0437 \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 GitLab \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043c\u0435\u0441\u044f\u0446\u044b. \u0412 \u044f\u043d\u0432\u0430\u0440\u0435 \u0431\u044b\u0434\u043b\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0443\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u0433\u0440\u043e\u0437\u0443 \u043e\u0431\u0445\u043e\u0434\u0430 2Fa (CVE-2026-0723), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c, \u0437\u043d\u0430\u044e\u0449\u0438\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0436\u0435\u0440\u0442\u0432\u044b, \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Community Edition \u0438 Enterprise Edition.\n\n\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 \u043f\u043e\u0444\u0438\u043a\u0441\u0438\u043b\u0438 \u0435\u0449\u0435 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 (CVE-2026-85706) \u0432 GitLab CE/EE, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u044b, \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.\n\n\u041f\u043e\u0437\u0436\u0435 CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u043e CVE-2026-85706 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 KEV, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0438\u0433\u0443\u0440\u0438\u0440\u0443\u0435\u0442 \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 GitLab, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0434\u043d\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u043d\u0434\u0430\u043c\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439.", "url": "https://t.me/true_secator/8706", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit": {"available": true, "seconds": 135006.0, "hours": 37.501666666666665, "days": 1.5625694444444445, "min_seconds": 135006.0, "max_seconds": 135006.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-11T22:00:00Z", "date_only": false, "value": "2026-10-11T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-10-13T11:30:06Z", "date_only": false, "value": "2026-10-13T11:30:06.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8706", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a44aa140-2d24-4812-ad8d-08136940ba10", "content": "GitLab \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0440\u043e\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0432 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 CI/CD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u0445.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GitLab, \u0447\u0442\u043e \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u043e\u0439 DevSecOps \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 30 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0431\u043e\u043b\u0435\u0435 50% \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430 Fortune 100, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Nvidia, T-Mobile, Lockheed Martin, Airbus \u0438 Goldman Sachs.\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-97229 \u0438 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c joaxcar, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0432\u0435\u0434\u043e\u043c\u0438\u043b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0437\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 HackerOne \u043e\u0442 GitLab.\n\nCVE-2026-97229 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0432 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 GitLab CI/CD, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442, \u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u0443\u0435\u0442 \u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u044f\u0435\u0442 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432.\n\n\u041a\u0430\u043a \u043f\u043e\u044f\u0441\u043d\u044f\u0435\u0442 GitLab, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 CI/CD \u0438\u0437-\u0437\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439.\n\nGitLab \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 GitLab Community Edition (CE) \u0438 Enterprise Edition (EE) \u0441 19.2 \u0434\u043e 19.2.8, \u0441 19.3 \u0434\u043e 19.3.4 \u0438 \u0441 19.4 \u0434\u043e 19.4.2, \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0437\u0432\u0430\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u044b.\n\n\u041d\u0430 GitLab.com \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f. \u041a\u043b\u0438\u0435\u043d\u0442\u0430\u043c GitLab Dedicated \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043d\u0435 \u043d\u0443\u0436\u043d\u043e.\n\nCVE-2026-97229 - \u044d\u0442\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0438\u0437 \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 GitLab \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043c\u0435\u0441\u044f\u0446\u044b. \u0412 \u044f\u043d\u0432\u0430\u0440\u0435 \u0431\u044b\u0434\u043b\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0443\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u0433\u0440\u043e\u0437\u0443 \u043e\u0431\u0445\u043e\u0434\u0430 2Fa (CVE-2026-0723), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c, \u0437\u043d\u0430\u044e\u0449\u0438\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0436\u0435\u0440\u0442\u0432\u044b, \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Community Edition \u0438 Enterprise Edition.\n\n\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 \u043f\u043e\u0444\u0438\u043a\u0441\u0438\u043b\u0438 \u0435\u0449\u0435 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 (CVE-2026-85706) \u0432 GitLab CE/EE, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u044b, \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.\n\n\u041f\u043e\u0437\u0436\u0435 CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u043e CVE-2026-85706 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 KEV, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0438\u0433\u0443\u0440\u0438\u0440\u0443\u0435\u0442 \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 GitLab, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0434\u043d\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u043d\u0434\u0430\u043c\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439.", "url": "https://t.me/true_secator/8706", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 126008.0, "hours": 35.00222222222222, "days": 1.458425925925926, "min_seconds": 126008.0, "max_seconds": 126008.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-11T22:00:00Z", "date_only": false, "value": "2026-10-11T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-10-13T09:00:08Z", "date_only": false, "value": "2026-10-13T09:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105131", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4ccd639d-e943-406f-8faa-2a161d8b8d2d", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AmpedWasTaken\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-13 08:51:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-97229 \u2014 GitLab CI/CD Regex Compiler RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105131", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": true, "seconds": 77321.0, "hours": 21.478055555555557, "days": 0.8949189814814815, "min_seconds": -9079.0, "max_seconds": 77321.0, "approximate": true, "ongoing": false, "order_known": false, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.2.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-10-23T21:28:41Z", "date_only": false, "value": "2026-10-23T21:28:41+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.2.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, "discovery_after_disclosure": true}, "disclosure_to_patch": {"available": true, "seconds": 1034921.0, "hours": 287.47805555555556, "days": 11.978252314814815, "min_seconds": 1034921.0, "max_seconds": 1034921.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-11T22:00:00Z", "date_only": false, "value": "2026-10-11T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-10-23T21:28:41Z", "date_only": false, "value": "2026-10-23T21:28:41+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.2.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}, "time_unpatched": {"available": true, "seconds": 1034921.0, "hours": 287.47805555555556, "days": 11.978252314814815, "min_seconds": 1034921.0, "max_seconds": 1034921.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-11T22:00:00Z", "date_only": false, "value": "2026-10-11T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3858", "record": "WID-SEC-W-2026-3858", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-10-23T21:28:41Z", "date_only": false, "value": "2026-10-23T21:28:41+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.2.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}, "exploitation_to_patch": {"available": true, "seconds": 899915.0, "hours": 249.9763888888889, "days": 10.41568287037037, "min_seconds": 899915.0, "max_seconds": 899915.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-13T11:30:06Z", "date_only": false, "value": "2026-10-13T11:30:06.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8706", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "a44aa140-2d24-4812-ad8d-08136940ba10", "content": "GitLab \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0440\u043e\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0432 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 CI/CD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u0445.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GitLab, \u0447\u0442\u043e \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u043e\u0439 DevSecOps \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 30 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0431\u043e\u043b\u0435\u0435 50% \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430 Fortune 100, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Nvidia, T-Mobile, Lockheed Martin, Airbus \u0438 Goldman Sachs.\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-97229 \u0438 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c joaxcar, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0432\u0435\u0434\u043e\u043c\u0438\u043b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0437\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 HackerOne \u043e\u0442 GitLab.\n\nCVE-2026-97229 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0432 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 GitLab CI/CD, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442, \u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u0443\u0435\u0442 \u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u044f\u0435\u0442 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432.\n\n\u041a\u0430\u043a \u043f\u043e\u044f\u0441\u043d\u044f\u0435\u0442 GitLab, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 CI/CD \u0438\u0437-\u0437\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439.\n\nGitLab \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 GitLab Community Edition (CE) \u0438 Enterprise Edition (EE) \u0441 19.2 \u0434\u043e 19.2.8, \u0441 19.3 \u0434\u043e 19.3.4 \u0438 \u0441 19.4 \u0434\u043e 19.4.2, \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0437\u0432\u0430\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u044b.\n\n\u041d\u0430 GitLab.com \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f. \u041a\u043b\u0438\u0435\u043d\u0442\u0430\u043c GitLab Dedicated \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043d\u0435 \u043d\u0443\u0436\u043d\u043e.\n\nCVE-2026-97229 - \u044d\u0442\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0438\u0437 \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 GitLab \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043c\u0435\u0441\u044f\u0446\u044b. \u0412 \u044f\u043d\u0432\u0430\u0440\u0435 \u0431\u044b\u0434\u043b\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0443\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u0433\u0440\u043e\u0437\u0443 \u043e\u0431\u0445\u043e\u0434\u0430 2Fa (CVE-2026-0723), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c, \u0437\u043d\u0430\u044e\u0449\u0438\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0436\u0435\u0440\u0442\u0432\u044b, \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Community Edition \u0438 Enterprise Edition.\n\n\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 \u043f\u043e\u0444\u0438\u043a\u0441\u0438\u043b\u0438 \u0435\u0449\u0435 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 (CVE-2026-85706) \u0432 GitLab CE/EE, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u044b, \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.\n\n\u041f\u043e\u0437\u0436\u0435 CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u043e CVE-2026-85706 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 KEV, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0438\u0433\u0443\u0440\u0438\u0440\u0443\u0435\u0442 \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 GitLab, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0434\u043d\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u043d\u0434\u0430\u043c\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439.", "url": "https://t.me/true_secator/8706", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-23T21:28:41Z", "date_only": false, "value": "2026-10-23T21:28:41+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.2.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}, "exploit_publication_to_patch": {"available": true, "seconds": 908913.0, "hours": 252.47583333333333, "days": 10.51982638888889, "min_seconds": 908913.0, "max_seconds": 908913.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-13T09:00:08Z", "date_only": false, "value": "2026-10-13T09:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105131", "record": "CVE-2026-97229", "field": "creation_timestamp", "uuid": "4ccd639d-e943-406f-8faa-2a161d8b8d2d", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AmpedWasTaken\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-13 08:51:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-97229 \u2014 GitLab CI/CD Regex Compiler RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105131", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-23T21:28:41Z", "date_only": false, "value": "2026-10-23T21:28:41+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:88861", "record": "RHSA-2026:88861", "field": "vulnerabilities.2.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}}}