GitLab's bundled regex compiler hands unauthenticated attackers a CVSS 10 RCE
What's Getting Pwned
A live tracker of ongoing security incidents, newest first, covering CVEs, affected versions, fixes, and the advisories behind each one. The feed currently counts 34 live incidents, 15 of them critical, with 17 not fully patched. Recent entries include a CVSS 10 unauthenticated RCE in self-managed GitLab, leaked unpatched Linux kernel bug reports, a LiteLLM supply-chain compromise, and a critical PHP core RCE.
Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.
- pixl97
Would be interesting to see what 2025 looked like in comparison.
The rate at which flaws are being found is just insane. Many people warned us in the past that our lax security postures would come back to bite us, and we're finally here.
- demibabs
Every ai generated page tries to cram way too much information in way too small a place
- xbar
After the first 8 hours of playing with Mythos, I was asked what I thought. My response, "this generation of LLMs is going to drive the largest wave of security incidents the world has ever seen."
It is still getting started.
- aeturnum
I don't understand the categorization for incidents. This signal vulnerability[1] is listed as "Live" and "ongoing" but was patched over a month ago (just announced today). If an incident with no known exploits is "ongoing" 1.5 months after the patch is released, when would it be over?
- aduwah
Missed opportunity not to call it pwnhub
- meerita
We are just witnessing the last days of sloppy human-written code. We'll reach a point where most bugs will be fixed.
- WarmWash
The thing to watch is what the CCP will do once people start abusing Chinese model capabilities. I don't think China wants to be the face of widespread cyber destruction (and definitely not a victim of it), and it only takes a single unhinged asshole to ruin it for everyone.
Also the flip side where Chinese models are used to attack US infra, just loading artillery shells into the "Ban Chinese Models" cannon.
- pjungwir
Pretty funny to look at Saturday & Sunday. The hackers decided to start working weekends?