Digest · Thursday

Security digest: October 29, 2026

3 editorial briefs and 2 known exploited (cisa kev) additions.

All digests · RSS · Markdown

Take stock

Act now: GitLab CVE-2026-97229: CVSS 10 CI Regex RCE Now Exploited. Operators of self-managed GitLab CE/EE 19.2, 19.3 or 19.4 below the fixed releases, and anyone running GitLab from source or a custom container image on stock Ruby, at GitLab 19.2 or later, even after upgrading GitLab.
Act now: C3RB3R. Owners of Synology NAS devices on DSM older than 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12, especially when DSM is reachable from the internet.
Check exposure: LXD and MicroCloud mTLS Auth Bypass CVE-2026-112816. Operators of LXD servers with core.https_address set, LXD clusters and MicroCloud deployments, especially where the API is reachable from shared or untrusted networks.
Do you run any of these? GitLab Community Edition and Enterprise Edition, Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-11-01.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

Oct 29, 2026 · Vulnerability · CVE-2026-97229

GitLab CVE-2026-97229: CVSS 10 CI Regex RCE Now Exploited

If you run self-managed GitLab 19.2 or later, confirm today that you are on a fixed official package, or on patched Ruby if you build GitLab yourself; attackers are already trying this against public instances.

Must act: Operators of self-managed GitLab CE/EE 19.2, 19.3 or 19.4 below the fixed releases, and anyone running GitLab from source or a custom container image on stock Ruby, at GitLab 19.2 or later, even after upgrading GitLab.

Can relax: GitLab.com and GitLab Dedicated customers, and instances on official Omnibus, Docker or Helm packages at 19.4.2, 19.3.5, 19.2.8 or later; 19.1 and older are outside this CVE but still need upgrading for CVE-2026-110264.

Check the exact GitLab version on every self-managed instance: sudo gitlab-rake gitlab:env:info, or the Admin area Dashboard.
Upgrade official packages to 19.5.3, 19.4.5, 19.3.7 or 19.2.10, which also fix CVE-2026-110264; at minimum reach 19.4.2, 19.3.5 or 19.2.8.
If you build GitLab from source or in your own image, also upgrade Ruby to 3.3.13, 3.4.12 or 4.0.9 and confirm with ruby -v inside the running container.

Read the brief →

Act now

Oct 29, 2026 · Vulnerability · CVE-2026-13639, CVE-2026-13684

Synology DSM: C3RB3R Ransomware Hits Unpatched NAS

Ransomware operators are encrypting Synology NAS boxes through DSM flaws that were patched in September 2026 and late 2024; if your DSM is behind the SA-26:13 builds, update today and get its admin interface off the internet.

Must act: Owners of Synology NAS devices on DSM older than 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12, especially when DSM is reachable from the internet.

Can relax: Owners already on those builds or later with DSM reachable only from a trusted LAN or VPN, and organizations that run no Synology devices.

Check the DSM version on every Synology device (Control Panel > Info Center, or cat /etc.defaults/VERSION over SSH).
Update to at least 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12, or the newest build for your model, and turn on automatic DSM updates.
Remove router port forwards to DSM and reach it over a VPN instead; limit admin access with the DSM firewall.

Read the brief →

Check exposure

Oct 29, 2026 · Vulnerability · CVE-2026-112816

LXD and MicroCloud mTLS Auth Bypass CVE-2026-112816

Only LXD hosts with the HTTPS API enabled, which includes every cluster and MicroCloud, are at risk, but there the bug is a full authentication bypass to root, so refresh the snap this week.

Must act: Operators of LXD servers with core.https_address set, LXD clusters and MicroCloud deployments, especially where the API is reachable from shared or untrusted networks.

Can relax: Single-host LXD installs that use only the local Unix socket (the default) and have never set core.https_address.

Check whether the HTTPS API is on with lxc config get core.https_address; an empty result means only the Unix socket is in use.
Check the installed version with snap list lxd and lxc version, then run sudo snap refresh lxd (and sudo snap refresh microcloud).
If the fixed revision has not reached your channel yet, restrict port 8443 (or your configured port) to management networks with a host or network firewall until it does.

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2026-97229	GitLab Community Edition and Enterprise Edition GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability	2026-11-01
CVE-2026-76418	Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability	2026-11-01

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.