SANS ISC’s latest Stormcast highlights several notable security items. First, GitLab is dealing with an integer overflow in its CI/CD regular expression compiler that could allow unauthenticated users to execute arbitrary code on the GitLab server. The issue is particularly impactful given GitLab’s central role in many organisations’ software supply chains.
The vulnerability was responsibly reported via HackerOne; the podcast notes that it affects on‑premise GitLab deployments, while GitLab’s cloud offerings may not be affected in the same way. Separately, Let’s Encrypt has announced that certificate lifetimes in staging will be reduced to 64 days from 14 October, with the live environment following on 10 February next year.
The vendor’s blog offers guidance on updating monitoring and handling increasingly short-lived certificates, and the presenter shares a personal experiment using 7‑day certificates to test alerting and renewal workflows.
The podcast also covers security concerns in mobile malware and enterprise software. Bitdefender describes Midnight Mimosa, a sophisticated piece of malware pre‑installed on certain certified pre‑owned Android devices, with fake model names such as S25 Ultra or i17 Pro designed to resemble flagship devices. The malware can disable Google Play, evade detection through ad-injection and clickjacking, and deploy a proxy botnet for attacker use.
Finally, Progress Software’s MarkLogic Data Management Platform and NoSQL database received its October 2026 updates; several fixes carry CVSS scores up to 9.9, predominantly addressing privilege escalation that can allow an attacker with low‑level query privileges to execute arbitrary code. Some flaws originate from a legacy API still enabled in these systems, reinforcing the need to apply updates when available.