Run your own GitLab? More than 1,000 servers still have the bug attackers use. Upgrade, then update Runner

We flagged GitLab’s exploited CI/CD bug on Friday, after CISA put it on its exploited list. Over the weekend Shadowserver counted how many servers still have it: more than 1,000 on the internet, three weeks after the fix.

A far bigger group is open to the second 10.0 bug GitLab fixed in October. If you run your own GitLab, the newest release also changes which certificates GitLab trusts, and Runner needs its own update.

Three weeks after the fix, more than 1,000 GitLab servers on the internet still have the bug attackers are using.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

More than 1,000 GitLab servers are still open to the exploited bug

Shadowserver said on Sunday it was tracking more than 1,000 GitLab instances vulnerable to CVE-2026-97229 and more than 11,300 vulnerable to CVE-2026-110264, out of about 39,000 it sees daily, BleepingComputer reports. CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler, has been on CISA’s Known Exploited Vulnerabilities catalog since October 29.

GitLab’s newest patch, released October 28 as 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11 and 18.11.14, removes trust for eight eMudhra intermediate CA certificates whose private keys were compromised (CVE-2026-111943). GitLab says upgrading GitLab does not update GitLab Runner, which checks certificates on its own.

Self-managed GitLab that skipped October’s releases

Any self-managed GitLab below 19.4.2, 19.3.5 or 19.2.8 is open to the exploited bug, and below 19.5.1, 19.4.3, 19.3.6 or 19.2.9 to CVE-2026-110264. GitLab.com and GitLab Dedicated need no action.

As we noted on Friday, servers built from source or on homemade container images also need the fixed Ruby (3.3.13, 3.4.12 or 4.0.9), because the fix lives in the regular expression engine inside Ruby.

Upgrade to 19.5.3, then update Runner on its own

• Upgrade to the newest release on your branch: 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11 or 18.11.14. Plan downtime on single-node servers, since 19.5.3 and 19.4.5 run database migrations.
• Update self-hosted GitLab Runner to 19.5.1, and rebuild any CI job images that ship their own ca-certificates package.
• If you built GitLab yourself, run ruby -v inside it and move to a fixed Ruby.

Details

• CVE-2026-97229: CI/CD regular expression integer overflow, unauthenticated code execution, GitLab score 10.0; fixed October 12 in 19.4.2, 19.3.5 and 19.2.8; CISA KEV October 29, due November 1.
• CVE-2026-110264: second regular expression compiler bug, 10.0; fixed in 19.5.1, 19.4.3, 19.3.6 and 19.2.9 (backported to 19.1.9, 19.0.10, 18.11.13).
• CVE-2026-111943: eMudhra intermediate CA distrust, fixed October 28 in 19.5.3 and the matching branch releases; Runner 19.5.1 and AI Gateway updates are separate.
• Exposure: Shadowserver, November 1: more than 1,000 vulnerable to CVE-2026-97229 and more than 11,300 to CVE-2026-110264, of about 39,000 GitLab instances seen daily.

Hunt / verify

• Check Admin, then Dashboard, or the /help page for the running GitLab version, and gitlab-runner --version on each runner host.
• Review new user sign-ups and public projects created since mid-October, plus crashed GitLab worker processes, which is what Alpine Linux saw before it rebuilt its server.

Source: BleepingComputer on Shadowserver’s count; GitLab 19.5.3 release

Sources

• BleepingComputer: Over 1,000 GitLab servers vulnerable to ongoing RCE attacks (November 2, 2026)
• The Shadowserver Foundation on Infosec Exchange: GitLab exposure counts
• GitLab: Patch Release and Security Update 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, 18.11.14
• GitLab: Critical Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 29, 2026)
• NVD: CVE-2026-97229

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].