---
title: "Security digest: October 29, 2026"
url: https://erroneo.us/security/2026-10-29/
description: "October 29, 2026 vulnerability digest: 3 briefs (GitLab CVE-2026-97229: CVSS 10 CI Regex RCE Now…); 2 CISA KEV additions (Cisco, GitLab). What to patch and…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-10-29
date_modified: 2026-11-03
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 29, 2026

3 editorial briefs and 2 known exploited (cisa kev) additions.

## Take stock

- Act now: GitLab CVE-2026-97229: CVSS 10 CI Regex RCE Now Exploited . Operators of self-managed GitLab CE/EE 19.2, 19.3 or 19.4 below the fixed releases, and anyone running GitLab from source or a custom container image on stock Ruby, at GitLab 19.2 or later, even after upgrading GitLab.
- Act now: C3RB3R . Owners of Synology NAS devices on DSM older than 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12, especially when DSM is reachable from the internet.
- Check exposure: LXD and MicroCloud mTLS Auth Bypass CVE-2026-112816 . Operators of LXD servers with core.https_address set, LXD clusters and MicroCloud deployments, especially where the API is reachable from shared or untrusted networks.
- Do you run any of these? GitLab Community Edition and Enterprise Edition, Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-11-01.
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [GitLab CVE-2026-97229: CVSS 10 CI Regex RCE Now Exploited](https://erroneo.us/security/briefs/gitlab-ci-regex-rce-cve-2026-97229-exploited/index.md): If you run self-managed GitLab 19.2 or later, confirm today that you are on a fixed official package, or on patched Ruby if you build GitLab yourself; attackers are already trying this against public instances.
- **Act now** [Synology DSM: C3RB3R Ransomware Hits Unpatched NAS](https://erroneo.us/security/briefs/synology-dsm-c3rb3r-ransomware-cve-2026-13639/index.md): Ransomware operators are encrypting Synology NAS boxes through DSM flaws that were patched in September 2026 and late 2024; if your DSM is behind the SA-26:13 builds, update today and get its admin interface off the internet.
- **Check exposure** [LXD and MicroCloud mTLS Auth Bypass CVE-2026-112816](https://erroneo.us/security/briefs/lxd-microcloud-mtls-chain-auth-bypass-cve-2026-112816/index.md): Only LXD hosts with the HTTPS API enabled, which includes every cluster and MicroCloud, are at risk, but there the bug is a full authentication bypass to root, so refresh the snap this week.

## Known exploited (CISA KEV)

- [CVE-2026-97229](https://erroneo.us/security/cve/CVE-2026-97229/index.md) GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability (CISA due 2026-11-01)
- [CVE-2026-76418](https://erroneo.us/security/cve/CVE-2026-76418/index.md) Cisco Secure Firewall ASA Software and Cisco Secure FTD Software: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability (CISA due 2026-11-01)

## Critical advisories

None.

---
Source page: https://erroneo.us/security/2026-10-29/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt