The US cyber agency says attackers are using a top-severity GitLab flaw that was fixed this month. Companies running their own GitLab server should update now.
Attackers are now using a maximum-severity flaw in GitLab, a popular tool software teams use to store and manage their code. The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Thursday that the flaw, tracked as CVE-2026-97229, is being exploited. GitLab fixed it earlier this month, so the attacks target servers that have not been updated.
The flaw sits in a part of GitLab that reads automated build instructions, known as CI/CD configuration files. A researcher using the handle joaxcar found it. An attacker who is not logged in could send a specially crafted piece of text and make the server run the attacker's own code. GitLab says the cause is weak checking of that text.
After spotting exploitation attempts, GitLab released threat detections to help customers who run their own servers. CISA then added the flaw to its list of known exploited vulnerabilities.
The risk is for organizations that run their own (self-managed) GitLab servers, in either the Community Edition or the Enterprise Edition. Fixed versions are 19.4.2, 19.3.5 and 19.2.8. Older ones are exposed. If your company does not use GitLab, this does not touch you directly. The reports do not say how GitLab's hosted service is affected.
Shadowserver, a group that tracks internet threats, counts nearly 2,800 GitLab Community Edition servers reachable from the internet. It does not say how many are already patched, so the number of vulnerable servers is unknown.
A server that runs an attacker's code is effectively in the attacker's hands. For a GitLab server, that can mean a company's source code is within reach. GitLab is widely used. It says over 50% of Fortune 100 companies use it, along with more than 70 million registered users.
This is also not the first alarm this month. GitLab fixed another maximum-severity flaw in the same regular expression component (CVE-2026-110264). Almost two weeks later, it fixed a third (CVE-2026-85706), which can expose passwords and other secrets. CISA flagged that one as exploited a day later.
The alert box above lays out the steps. In short, find out which version your team runs and update it. CISA has told federal agencies to secure their servers by Sunday. That order covers only agencies, but CISA urged private companies to treat the fix as a priority too.
Expect more scanning for unpatched servers. Earlier this month, security firm watchTowr reported attackers scanning the internet for exposed GitLab servers, and CISA has tagged six GitLab flaws as exploited since November 2021. What is still unknown is who is behind the current attacks and how many servers were hit.
If your company runs its own GitLab server, update it to a fixed version now, because attackers are already using this flaw.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
