GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

thehackernews.com Oct 13, 2026

GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

Curated by Shubham · TechCapsules · Oct 13, 2026

AI-summarised brief · reviewed before publication

GitLab issued patches for a critical CVE‑2026‑97229 vulnerability affecting both its Community and Enterprise editions. The flaw, rated CVSS 10.0, stemmed from an integer overflow in regular‑expression validation within CI/CD configurations, allowing an unauthenticated attacker to execute arbitrary code on the server. Updated releases—19.4.2, 19.3.5 and 19.2.8—contain the fix and also resolve three additional high‑severity bugs. The advisory follows GitLab’s recent remediation of a 9.9‑scored AI Gateway issue and a prior 10.0‑rated flaw (CVE‑2026‑85706) that saw active probing after disclosure. GitLab’s rapid response underscores the company’s focus on hardening its platform amid rising exploitation of AI‑driven attack vectors.

💡 Why It Matters

· The patch thwarts a remote code path that could have let attackers hijack CI pipelines, protecting countless development workflows from immediate compromise.

Capsules Cybersecurity

Read full article on thehackernews.com

Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

Progress Software disclosed 31 new vulnerabilities in its MarkLogic Server database, five of them rated critical. Two flaws allow accounts with limited management rights to obtain full administrator control by exploiting forest‑scoped grants and XQuery function misuse. Fixes have been available since September 10 in MarkLogic 11.3.7 and 12.1.0, but earlier patches for ten August flaws do not cover the new issues. The critical CVEs score 9.9 and 9.6 on the CVSS scale; one high‑severity bug (8.6) can elevate privileges through crafted XQuery values. Upgrade notes warn of behavior changes that may break existing code and note residual problems such as unchanged log file permissions and incomplete Kerberos checks. Researchers reported four of the five critical bugs via Bugcrowd in total.

💡 Attackers can hijack delegated management roles to seize full control, eroding confidence in MarkLogic’s granular permission model.

thequantuminsider.com · Oct 12

IonQ Agrees to Buy Elisity in Cybersecurity Deal Worth Up to $1.3…

IonQ has agreed to acquire cybersecurity firm Elisity in an all‑stock transaction valued at up to $1.3 billion, including up to $150 million in performance‑based earn‑outs. Elisity, founded in 2019, supplies software that stops ransomware and other attackers from spreading through corporate networks, serving clients such as hospitals and health‑care companies. The deal expands IonQ’s security portfolio, positioning the quantum‑computing company to address emerging threats from AI and quantum technologies. Elisity’s CEO James Winebrenner is expected to stay post‑acquisition.

💡 The purchase signals a growing convergence between quantum computing and cybersecurity, underscoring the urgency for enterprises to fortify defenses ahead of the anticipated “Q‑Day.” It also provides IonQ with a ready‑made customer base and proven policy‑enforcement expertise, accelerating its transition to a full‑stack quantum platform.

quantumcomputingreport.com · Oct 12

IonQ to Acquire Elisity for Up to $1.3 Billion to Integrate Zero…

IonQ (NYSE: IONQ) announced a definitive agreement to acquire Zero Trust cybersecurity firm Elisity, Inc. in an all‑stock transaction valued at up to $1.3 billion, including up to $150 million in performance‑contingent earnouts. The deal will merge IonQ’s hardware‑level post‑quantum cryptography (PQC) and quantum key distribution (QKD) capabilities with Elisity’s software‑defined Zero Trust policy framework and its IdentityGraph engine. After closing, the combined entity will add cryptographic inventory and risk data to the IdentityGraph, allowing enterprise and government customers to protect against “harvest now, decrypt later” threats while preserving least‑privilege access during multiyear PQC migrations. The acquisition follows IonQ’s strategy of bolstering its quantum infrastructure portfolio, building on prior purchases of SkyWater Technology, ID Quantique and Qubitekk.

💡 By uniting quantum‑grade encryption with Zero Trust controls, the merger creates a rare end‑to‑end solution that directly counters emerging long‑term decryption threats. This positions IonQ as a pivotal supplier for organizations needing both quantum‑ready hardware and immediate cyber‑resilience.

thehackernews.com · Oct 12

CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

Cybersecurity researchers have uncovered a dual‑track AI‑enhanced intrusion campaign run by a Russian‑speaking broker known as CyberXero. The group combines off‑the‑shelf tools such as Cobalt Strike with Anthropic’s Claude Code to automate attacks on vulnerable WordPress and e‑commerce sites while manually targeting Ukrainian energy and critical‑infrastructure operators. Exploiting flaws like CVE‑2026‑63030, CVE‑2026‑60137 and a SQL‑injection bug in the Support Board plugin, the automated pipeline scanned 4,708 sites, seized 429 admin panels and deployed 32 web shells within a minute. The focused pipeline breached four Ukrainian entities, exfiltrating over 628,000 personal records, and also compromised assets in Poland, China and the Netherlands. Open‑directory leaks revealed AI session logs, plaintext tokens and toolkits, confirming the operation remains active.

💡 By integrating generative AI to bypass model safeguards, CyberXero demonstrates a scalable method for cyber‑criminals to accelerate large‑scale data theft while retaining the ability to conduct precision attacks on critical infrastructure.

gamesradar.com · Oct 12

As Gears of War: E-Day servers suffer DDoS attack, the devs are…

The Coalition confirmed that Gears of War: E‑Day’s online services suffered distributed denial‑of‑service attacks on October 12, causing intermittent disconnects, login failures and other disruptions for players worldwide. The developer posted on Twitter that the attacks began earlier in the day and that technical teams are actively mitigating the traffic and monitoring the situation. Normal multiplayer functionality is expected to return soon, though some users reported hours of instability. The incident comes just days after the game’s launch on October 6, interrupting the transition of many players from single‑player campaign to multiplayer modes. The studio thanked the community for patience while it works to firewall the attackers. The outage highlights the vulnerability of launched live‑service titles to coordinated cyber threats.

💡 A fresh‑release title being knocked offline underscores how quickly cyber attacks can derail player engagement during critical launch windows.

thehackernews.com · Oct 12

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

Patchstack reported active exploitation of a CVSS 10.0 vulnerability in the Bricksforge WordPress plugin (CVE‑2026‑85097). The flaw, present in versions through 3.1.8.9, lets unauthenticated attackers upload a GIF/PHP polyglot, then manipulate the ‘temporaryFileUploads’ URL field to execute arbitrary PHP code via the plugin’s form‑submission endpoints. Exploits were first seen on Oct. 7, 2026, targeting the REST API (/wp‑json/bricksforge/v1/form_submit) and admin‑ajax.php actions, using varied PHP extensions and encodings to bypass filters. Patchstack observed 63 source IPs, with automated patterns suggesting rotating proxies. Bricksforge released a fix in version 3.1.8.10, and users are urged to upgrade to 4.0.1 and monitor the affected endpoints for suspicious activity. Security researchers noted that sites could be used to host web shells, steal credentials, and launch attacks visitors.

💡 The exploit turns a popular visual‑builder plugin into a remote‑code gun, giving attackers immediate server control on thousands of WordPress sites.