#ruby
-
Alpine Linux rebuilds its GitLab after an attempted exploit of a critical vulnerability
An attacker came close to compromising Alpine Linux's GitLab instance via CVE-2026-97229. No evidence of a breach was found, but the server was rebuilt from scratch and all passwords were reset as a precaution.
-
Ruby Fixes Three Regex Engine Bugs Behind Four Critical GitLab RCE Flaws
Ruby has shipped 4.0.9, 3.4.12 and 3.3.13 to fix flaws in the Onigmo regex engine that drove four critical GitLab patches in a month. Any app that compiles a regular expression from attacker-controlled text is at risk.
-
KindaRails2Shell: a Critical RCE Vulnerability in Rails via Active Storage
Ethiack researchers have disclosed CVE-2026-66066 in standard Ruby on Rails applications that use Active Storage with the vips processor. It allows arbitrary file reads and remote code execution.
-
PoC Exploit for GitLab: An Authenticated User Gains Command Execution as git
A researcher has published a working exploit for unpatched self-managed GitLab: all it takes is to commit two crafted Jupyter notebooks and request a diff of them.