Shadowserver tracks more than 1,000 internet-exposed GitLab servers still unpatched against CVE-2026-97229, a maximum-severity integer overflow in the CI/CD Regular Expression Compiler that lets an unauthenticated user execute arbitrary code via a crafted regular expression in a pipeline configuration. GitLab patched the flaw on 12 October in Community and Enterprise editions 19.4.2, 19.3.5 and 19.2.8, and CISA confirmed in-the-wild exploitation when it added the CVE to its Known Exploited Vulnerabilities catalog on 29 October. Shadowserver's Sunday data also counts around 11,300 instances vulnerable to a separate last-month regex-compiler flaw, CVE-2026-110264, out of roughly 39,000 GitLab instances it sees daily. The exposure matters because GitLab is the DevSecOps platform for more than half of the Fortune 100: an unauthenticated RCE on the CI server is effectively domain-admin-equivalent access to an organisation's software supply chain. Patches have been available for three weeks, so the residual 1,000-plus is a patch-management failure rather than a vendor gap.

• Source article