Skip to content
OriginalSign in

The Hacker Newsinfo@thehackernews.com (The Hacker News)

CISA Adds Exploited GitLab and Cisco Flaws to KEV

Part of the CVE-2026-97229 story · since 12 Oct

Developinglatest 2 hours ago12 articles6 outlets
12 Oct · SecurityOnline first22 Oct25 OctNowThis article12th of 12
  • Mon 12 Oct, 09:11 UTC. SecurityOnline, first report. Critical GitLab flaw lets unauthenticated attackers run code on servers. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 09:12 UTC. The Hacker News, its first report on the story. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 12:50 UTC. Rapid7, its first report on the story. GitLab fixes critical flaw that lets attackers execute code via CI/CD regexes. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 13:28 UTC. SOCRadar, its first report on the story. GitLab rushes to patch critical flaw enabling unauthenticated server takeover. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 14:37 UTC. Security Affairs, its first report on the story. GitLab patches critical flaw letting attackers run code without logging in. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 11:01 UTC. SecurityOnline. Critical GitLab CI flaw enables unauthenticated remote code execution. Cites a CVE in CISA KEV.
  • Fri 16 Oct, 15:37 UTC. Rapid7. GitLab fixes critical CI/CD flaw enabling unauthenticated remote code execution. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 03:21 UTC. SecurityOnline. Ruby fixes regex flaws that could enable GitLab server attacks. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 00:00 UTC. SecurityOnline. Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 12:01 UTC. The Hacker News. Attacker Targets Alpine Linux GitLab Server With CVE-2026-97229. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 20:00 UTC. CISA, its first report on the story. CISA Adds Actively Exploited GitLab Code Execution Flaw to KEV. Cites a CVE in CISA KEV.
  • Fri 30 Oct, 08:30 UTC. The Hacker News. CISA Adds Exploited GitLab and Cisco Flaws to KEV. Cites a CVE in CISA KEV. This article, 12th of 12.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue, affecting Cisco Secure Firewall and GitLab. CVE-2026-97229, rated CVSS 10.0, is an integer overflow in GitLab Community and Enterprise Editions that can allow unauthenticated code execution on a GitLab server via a specially crafted CI/CD configuration due to insufficient regex validation.

CVE-2026-76418, with CVSS 8.6, is an unchecked return value leading to a NULL pointer dereference in Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software, potentially allowing an unauthenticated remote attacker to trigger a device reload and a denial-of-service condition. Cisco has stated it is aware of active exploitation of the latter vulnerability, but has not publicly identified the attackers or targets.

The Alpine Linux team disclosed prior exploitation attempts related to CVE-2026-97229, noting that an unknown threat actor probed an unpatched GitLab instance and downloaded the GitLab container image, with the attacker’s subsequent attempts on 25 and 26 October 2026 blocked. CISA and the Alpine incident underscore the urgency for remediation. U.S. Federal Civilian Executive Branch agencies are urged to apply the fixes by 1 November 2026.

The advisory attributes the findings to Cisco and Alpine Linux, without identifying additional targets or actions taken by attackers beyond the noted exploitation attempts.

How the story developed

All 12 articles
Developinglatest 2 hours ago12 articles6 outlets

12 articles from 6 outlets since 12 Oct. Picked up again on 29 Oct after 3 days quiet. This was the 12th report, 18 days after the first.

Now12 Oct14151626272829First reportSecurityOnline · 12 Oct, 09:11This article12th of 12 · day 18CISA alert29 Oct, 20:00 · official
  • Mon 12 Oct, 09:11 UTC. SecurityOnline, first report. Critical GitLab flaw lets unauthenticated attackers run code on servers. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 09:12 UTC. The Hacker News, its first report on the story. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 12:50 UTC. Rapid7, its first report on the story. GitLab fixes critical flaw that lets attackers execute code via CI/CD regexes. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 13:28 UTC. SOCRadar, its first report on the story. GitLab rushes to patch critical flaw enabling unauthenticated server takeover. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 14:37 UTC. Security Affairs, its first report on the story. GitLab patches critical flaw letting attackers run code without logging in. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 11:01 UTC. SecurityOnline. Critical GitLab CI flaw enables unauthenticated remote code execution. Cites a CVE in CISA KEV.
  • Fri 16 Oct, 15:37 UTC. Rapid7. GitLab fixes critical CI/CD flaw enabling unauthenticated remote code execution. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 03:21 UTC. SecurityOnline. Ruby fixes regex flaws that could enable GitLab server attacks. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 00:00 UTC. SecurityOnline. Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 12:01 UTC. The Hacker News. Attacker Targets Alpine Linux GitLab Server With CVE-2026-97229. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 20:00 UTC. CISA, its first report on the story. CISA Adds Actively Exploited GitLab Code Execution Flaw to KEV. Cites a CVE in CISA KEV.
  • Fri 30 Oct, 08:30 UTC. The Hacker News. CISA Adds Exploited GitLab and Cisco Flaws to KEV. Cites a CVE in CISA KEV. This article, 12th of 12.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 12 articles as a list
  1. Mon 12 OctDay 01
    1. Critical GitLab flaw lets unauthenticated attackers run code on servers09:11 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
  2. Tue 13 OctDay 14
    1. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code09:12 · The Hacker News · Known exploited CVE
    2. GitLab fixes critical flaw that lets attackers execute code via CI/CD regexes12:50 · Rapid7 · Known exploited CVE
    3. GitLab rushes to patch critical flaw enabling unauthenticated server takeover13:28 · SOCRadar · Known exploited CVE
    4. GitLab patches critical flaw letting attackers run code without logging in14:37 · Security Affairs · Known exploited CVE
  3. Wed 14 OctDay 21
    1. Critical GitLab CI flaw enables unauthenticated remote code execution11:01 · SecurityOnline · Known exploited CVE

  4. Quiet for 2 days

    Fri 16 OctDay 41
    1. GitLab fixes critical CI/CD flaw enabling unauthenticated remote code execution15:37 · Rapid7 · Picked up again · Known exploited CVE

  5. Quiet for 9 days

    Mon 26 OctDay 141
    1. Ruby fixes regex flaws that could enable GitLab server attacks03:21 · SecurityOnline · Picked up again · Known exploited CVE

  6. Quiet for 3 days

    Thu 29 OctDay 173
    1. Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw00:00 · SecurityOnline · Picked up again · Known exploited CVE
    2. Attacker Targets Alpine Linux GitLab Server With CVE-2026-9722912:01 · The Hacker News · Known exploited CVE
    3. CISA Adds Actively Exploited GitLab Code Execution Flaw to KEV20:00 · CISA · official · CISA alert · Known exploited CVE
  7. Fri 30 OctDay 181
    1. CISA Adds Exploited GitLab and Cisco Flaws to KEV08:30 · The Hacker News · Known exploited CVE · This article, 12th of 12

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in