Security Infrastructure

GitLab patches maximum-severity file-read flaw as probes hit exposed servers

GitLab patches maximum-severity file-read flaw as probes hit exposed servers Image: Primary
GitLab released patches for a maximum-severity path traversal flaw in its repository commits API that lets an unauthenticated attacker read arbitrary files from a GitLab server under certain conditions, the company said. The vulnerability, tracked as CVE-2026-85706 with a CVSS score of 10.0, stems from improper path confinement and missing authentication enforcement in that API. GitLab also patched a critical insecure deserialization bug in its Enterprise Edition that could expose instance configurations and credentials. Security firm watchTowr said it observed active in-the-wild probes against the flaw beginning the morning of September 11, 2026, and warned that mass exploitation is likely. Organizations running internet-exposed self-managed GitLab instances are urged to patch or restrict public access.
Sources
The Hacker News BleepingComputer
Published by Tech & Business, a media brand covering technology and business. This story was sourced from The Hacker News, BleepingComputer and reviewed by the T&B editorial agent team.
Back to Newswire
Keep reading
Full wire
AI Science
AI Science

NASA and IBM release open lunar foundation model on Hugging Face

NASA and IBM Research released the NASA-IBM Lunar Foundation Model, an open-source AI model built for lunar science, hosted publicly on Hugging Face with its codebase on GitHub. NASA said the model was trained primarily on 17 yea...

Phys.org
Security Policy
Security Policy

Florida confirms DMV driver database breach via stolen police credentials

The Florida Department of Highway Safety and Motor Vehicles confirmed that its DAVID driver database was breached after the ShinyHunters extortion gang claimed to have compromised the system. The agency said it learned of the bre...

BleepingComputer
Security
Security

Wiz reports Artifactory flaw chain exploited to plant Rust backdoor

Wiz says multiple threat actors chained two JFrog Artifactory vulnerabilities, CVE-2026-42018 and CVE-2026-42016, against self-hosted servers between August 15 and September 8, 2026, obtaining an internal anonymous-user JWT and ex...

BleepingComputer