LIVE · cybersecurity feed
Live wire
CVE-2026-19478 · GitLab Critical GraphQL Flaw Actively ExploitedCVE-2026-73570 · Poland’s CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite FlawCISA Urges Immediate Patching of Exploited TrueConf VulnerabilitiesCVE-2026-12569 · Cl0p Targets 40+ Organizations Through PTC Windchill FlawCVE-2026-69836 · Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code ExecutionManic: The Android Malware That Exfiltrates Data Even When the Phone Is OfflineHackers poison arrayref Rust crate to push infostealer malwareNSA, CISA, FBI, DOE, and EPA Warn of Active AI-Assisted Attacks on Siemens S7 PLCsSenators press TikTok over withholding of safety features for some usersAI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure
CVE-2026-19478critical

GitLab Critical GraphQL Flaw Actively Exploited

GitLab has released an emergency patch for a critical vulnerability in its GraphQL API that allows unauthenticated attackers to modify or delete public projects and user data. Researchers from WatchTowr discovered the flaw, tracked as CVE-2026-19478, which has a CVSS score of 9.4 and is reportedly under active exploitation. The vulnerability affects self-managed installations, and users are urged to upgrade to specific patched versions, as older branches will not receive direct fixes.

zeroday.news ·

GitLab has confirmed that a critical vulnerability in its GraphQL API, identified as CVE-2026-19478, is being actively exploited in the wild. The flaw, which carries a CVSS score of 9.4, allows unauthenticated attackers to remotely modify or delete public projects and associated user data on self-managed GitLab instances.

The company issued an emergency patch on August 17, five days after its regular update cycle, to address the vulnerability. This followed a report by hiimguardian through GitLab's HackerOne bug bounty program.

According to GitLab's advisory, the issue could allow an unauthenticated user to manipulate public projects and user data via a GraphQL directive under specific conditions. WatchTowr researchers have also warned of the active exploitation of this critical flaw.

The vulnerability affects self-managed GitLab installations. Users are urged to upgrade to versions 19.2.4, 19.1.6, 19.0.8, or 18.11.11. It is important to note that patches are not available for versions 18.2 through 18.10, despite these versions falling within the affected range. Organizations running these older versions must upgrade to a currently supported and patched branch.

For organizations unable to immediately apply the patches, temporary mitigation strategies include restricting unauthenticated access to the `/api/graphql` endpoint and disabling public repositories where feasible. Administrators should also review their logs for requests containing the string `@gl_introduced`, which may indicate attempted exploitation.

gitlabgraphqlvulnerabilityexploitationpatch
ShareXLinkedInWhatsAppFacebook

More News

view all →
security

Calling on Cyber Pros to Help Defend City Hall

Government agencies with smaller budgets need support — and here's how you can help.

breach

SickKids data breach exposes employee and job applicant info

Toronto's Hospital for Sick Children (SickKids) says a cybersecurity incident exposed the personal information of some current and former employees and job applicants, stemming from a flaw in third-party software. Clinical systems and patient records were not affected. (264) [...]

ai

More Incidents of AIs Going Rogue in Cybersecurity Challenges

The AI Security Institute has a new report of AI systems engaging in “unsanctioned behavior”—what I have been calling “genie behavior—while being tested on their cybersecurity capabilities. The incident stemmed from a single evaluation where agents were given a task of solving a cyber security challenge. We ran this challenge 122 times across several models. Our investigation found that in 10 of t

security

Rust Supply Chain Attack Linked to North Korean Hackers

Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server. The post Rust Supply Chain Attack Linked to North Korean Hackers appeared first on SecurityWeek.

CVE-2026-73570critical

Poland’s CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw

CERT Polska confirmed active exploitation of CVE-2026-73570, a critical unauthenticated RCE in Zimbra Collaboration Suite patched on July 20. CERT Polska, Poland’s national computer emergency response team, confirmed this week that threat actors are actively exploiting a critical vulnerability in Zimbra Collaboration Suite tracked as CVE-2026-73570. The flaw allows unauthenticated remote code exec

security

Contractors’ CMMC Confidence Rises as Ability to Prove It Falls Behind

Two industry surveys released this week by Kiteworks and CyberSheath paint a consistent picture of the defense industrial base. The post Contractors’ CMMC Confidence Rises as Ability to Prove It Falls Behind appeared first on SecurityWeek.