Unidad de cinta LTO-6 y ranuras de una biblioteca IBM TS3500

GitLab's official recovery procedure starts with a DELETE

On 12 October GitLab shipped three versions over a CVSS 10.0 flaw that allows code execution on the server, and the release note itself warns that on a single-node instance the patch takes the instance down. If you also decide a rebuild is needed, the documented route when the secrets file is missing is to delete your CI/CD variables, null out runner tokens and disable two-factor authentication for everyone. Nine things stop being accessible; the code is not one of them.

Backup Cybersecurity GitLab

Read more →

Cuarto de cableado de un edificio con un conmutador sobre una balda, bloques de conexión antiguos y latiguillos sueltos

11 Oct 2026 9 min read

Only one of the eight exploited flaws is in a network appliance

Joint advisory AA26-281A, signed in Spain by the CNI, lists eight CVEs successfully exploited by Flax Typhoon. One is in a network appliance, a Pulse Connect Secure; the other seven are software on servers: Bash and BIND ship with the OS, Struts travels inside a Java application, and ProFTPD, GitLab, ONLYOFFICE Docs and Strapi were stood up by someone on a specific day. Three were already in CISA's catalogue, two since November 2021 with the ransomware flag set. The counts done on the catalogue JSON, with the commands, and the three questions that actually build that inventory.

Cybersecurity Vulnerabilities Inventory

Read more →

Dos portátiles abiertos sobre una mesa de oficina y una mano escribiendo sobre unos papeles

19 Sep 2026 7 min read

The agent pinned the plugin's commit. Git handed it the attacker's branch

Plugin4Shell affects the four most widely used AI coding agents: they clone the plugin repository, check out the pinned commit and never verify they landed on it. We reproduced in the lab, with git 2.43, the git behaviour it rests on: exit code 0, a warning nobody reads, and the attacker's content in the working tree. The same 40-character string gives a different answer depending on which git command reads it, so auditing with git log is no help. And today's defence today depends above all on where the plugin repository is hosted.

IA Cybersecurity DevOps

Read more →

Estanterías de un depósito de archivo con legajos y cajas de documentos etiquetados

13 Sep 2026 9 min read

"Read-only" does not exist: GitLab scores 10.0 on a flaw that can only read

CVE-2026-85706 lets a stranger read files off a self-hosted GitLab server. It writes nothing, and it still carries the maximum score. The explanation is not in the headline: it is in the vector the vendor itself signed off, with a changed scope and high integrity impact. We go through what the vector says, why CISA gave it three days and a forensic triage flag, and how to answer the one question the patch does not: were we read?

Cybersecurity GitLab Vulnerabilities

Read more →

Caja fuerte pequeña de oficina abierta sobre una repisa, con dos sobres, un juego de llaves y una memoria USB dentro

19 Aug 2026 5 min read

Cloning the repository is not a GitLab backup

On 17 August GitLab shipped four out-of-band releases for a flaw that lets an unauthenticated user modify or delete public projects. The usual answer — "we have the code cloned everywhere" — is true, and it is the part you are least likely to lose. What a clone actually carries, what lives only on the server, why the secrets file is not inside the backup, and why the June fix, the one with no CVE, explains the problem better.

CI/CD Backup DevOps

Read more →

everyWAN Blog

GitLab's official recovery procedure starts with a DELETE

Only one of the eight exploited flaws is in a network appliance

The agent pinned the plugin's commit. Git handed it the attacker's branch

"Read-only" does not exist: GitLab scores 10.0 on a flaw that can only read

Cloning the repository is not a GitLab backup

Subscribe to our newsletter