GitLab issued an urgent multi-version patch (19.5.1 and backports to 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13) addressing multiple security flaws and bugs, and strongly urges immediate upgrades for self-managed instances. The most critical fix closes CVE-2026-110264: an integer overflow in the regular expression compiler (Onigmo) that could allow unauthenticated remote code execution, rated CVSS 10.0 and backported to several supported branches. GitLab.com and Dedicated are already patched. Two detection signatures - Onigmo native worker crash and org-mode render error bursts - are provided to help identify exploitation attempts. Security disclosures will be public 90 days after release.
The release also contains high- and medium-severity fixes including CVE-2026-15723 (OmniAuth-to-LDAP auto-linking allowing account takeover, CVSS 8.2), CVE-2026-112212 (OAuth/OIDC discovery cache poisoning, CVSS 7.5), CVE-2026-12664 (GraphQL work-item email field leaking project email addresses, CVSS 6.8), and CVE-2026-16255 (incomplete enforcement of SAML/LDAP membership lock, CVSS 5.9). Additional remediation covers internal credential exposure, authorization bypasses in group milestones, AI feature enablement trust issues, cache leakage of confidential titles, and various access-control and cleanup bugs with lower CVSS scores. Individual reporters and internal team members are credited for discoveries.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.