Attackers are using a top-severity GitLab flaw to take over servers, and Shadowserver still sees more than 1,000 unpatched ones online weeks after a fix.
More than 1,000 GitLab servers on the open internet have still not been fixed against a flaw that attackers are using right now. GitLab released the fix on October 12. The US cyber agency CISA says criminals have started exploiting the problem, which carries the highest severity rating.
The flaw is tracked as CVE-2026-97229. GitLab is a platform many companies use to store and manage their software code. The bug sits in the part that reads pipeline settings, the automated steps that build and test software. A specially crafted text pattern in those settings could let a stranger run their own commands on the server, without logging in.
On Friday, CISA added the flaw to its list of known exploited vulnerabilities and told federal agencies to secure their servers by Sunday. Over the weekend, the monitoring group Shadowserver said it tracks more than 1,000 servers still open to it.
The risk is for organizations that run their own GitLab Community Edition or Enterprise Edition servers. GitLab says the fixed versions are 19.4.2, 19.3.5 and 19.2.8. A server on an older version is exposed.
Customers of GitLab.com can relax on this one, since GitLab says it already runs the patched version. GitLab Dedicated customers also do not need to act.
This is the latest in a run of GitLab problems this year. In January, GitLab fixed a flaw that let attackers get around two-factor login. In September came a top-severity bug that could be used to steal passwords and other secrets. CISA also flagged that one as abused in real attacks.
Last month brought another top-severity bug in the same pattern-reading component, tracked as CVE-2026-110264. Shadowserver counts more than 11,300 servers still vulnerable to it, out of about 39,000 GitLab servers it sees each day. Since November 2021, CISA has listed six GitLab flaws as actively exploited. One of them has also been used in ransomware attacks.
GitLab says it has over 70 million registered users and is used by more than half of the Fortune 100. A taken-over server can give outsiders access to the code and secrets kept on it. For a business, that can mean exposed customer systems, stolen keys and a long cleanup.
The alert box above lists the steps. The short version: confirm your version, update, and check that last month's fix is in place too. If your server was behind on updates, have your IT team look for signs of break-in.
The material does not say who is behind the attacks or how many servers have been taken over. It also does not say how many of the 1,000 servers belong to businesses versus hobbyists. Shadowserver's counts will likely keep changing as owners patch.
If you run your own GitLab server, update to a fixed version today and check last month's patch too.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
