This PHP vulnerability is just the beginning https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
The Hacker NewsCritical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of ReleasesGitLab fixes CVE-2026-110264, a critical flaw that could allow unauthenticated code execution on self-managed versions dating back to 7.0.
commit ebaf6d1