Security
GitLab patches maximum-severity flaw reaching back to 2014
GitLab fixes a CVSS 10.0 unauthenticated RCE, Railway tells all users to rotate keys, and Node2Shell hits Node.js.
This edition was produced with artificial intelligence. Text and voice are generated automatically.
GitLab ships emergency fix for CVSS 10.0 flaw spanning 12 years of releases
GitLab released fixes on October 21 for CVE-2026-110264, a maximum-severity 10.0 flaw that could let an unauthenticated attacker run arbitrary code on self-managed servers. The bug is an integer overflow in the regex compiler tied to Ruby’s Onigmo engine, which GitLab ships in its own packages, so every release back to 7.0 from 2014 is affected. The October 12 update covered only 19.2 and later, leaving recently patched instances exposed again. Fixed versions include 19.5.1, 19.4.3 and 18.11.13, with backports beyond GitLab’s usual policy. No exploitation has been reported. GitLab.com and Dedicated tenants already run fixed code.
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases →
Topics: Patch Tuesday & security updates
Railway tells all users to rotate API and cloud keys after breach
Railway confirmed a cyberattack in which hackers may have accessed encrypted environment variables and, for some, obtained their decrypted contents. In a Wednesday blog post, the developer platform said initial analysis suggests the breach was limited to a subset of users, but it recommended all users revoke and rotate their API and cloud keys so attackers cannot abuse them. Environment variables typically hold passwords and API keys that apps use to reach cloud storage and databases. Railway briefly paused new builds and deployments during the investigation and began restoration soon after. The company did not say how many users were affected or identify a root cause. Founder and CEO Jake Cooper said a post-mortem is planned, and Railway said the attack was likely part of a broader campaign targeting platforms to compromise AI inference providers.
Developer platform Railway urges 'all users' to revoke secret keys after cyberattack | TechCrunch →
Topics: Third-party and vendor breaches
Node2Shell Brotli flaw in Node.js allows remote code execution
Node.js released a security update on October 21, 2026, for CVE-2026-111497, dubbed Node2Shell, an out-of-bounds write in the Brotli decoder triggered by malformed compressed input. Node.js rates it high severity, one step below critical, with impact described as remote code execution; it can also crash the process or leak memory. Every supported release line was affected, as was Bun until 1.4.4. Fixed versions are Node.js 22.23.4, 24.22.1 and 26.12.1. The fix is an upstream Brotli patch that makes the decoder reject invalid input before writing past the buffer. No exploitation in the wild had been reported as of October 22. Vercel added firewall rules blocking the attack in inbound requests.
Topics: Patch Tuesday & security updates
Malicious AGENTS.md in Downloads folder hijacks coding agents
Forever Security found a malicious AGENTS.md file in the Downloads folder of a real customer machine, disguised as engineering notes. A coding agent obeys an AGENTS.md in the folder it opens, and Downloads is the one folder a website can write to without a click or permission, so the web can plant instructions an agent will execute. The file makes the agent rewrite its own configuration, enabling remote code execution or theft of its login token. The chain was reproduced on OpenAI Codex and Claude Code. On Codex, the attacker file added an MCP server to the machine-wide config and installed the malicious npm package function-color, running in over 90% of attempts. Neither vendor has anything to patch.
Topics: AI coding agents securityAI agent skills, plugins and MCP
Chrome to distrust eMudhra root, forcing university certificate replacements
Chrome will distrust the eMudhra root certificate emSign ECC Root CA - G3 on Tuesday, October 27; Mozilla has already distrusted it. Chrome counted about 30,800 unexpired certificates under that root, 30,791 issued through InCommon, the certificate service Internet2 runs for higher education. A key ceremony error created a second set of weak keys that eMudhra’s root signed; researcher Scott Helme recovered all eight in under a second. The weak keys were revoked but never used for customer certificates, though anyone can forge with them. On October 22, eMudhra said it is leaving the TLS certificate business. Universities had until Tuesday to replace certificates.
Internet2's certificate authority (eMudhra) is being distrusted →
Topics: Chrome security