GitLab Patches Critical CVSS 10 Unauthenticated RCE Flaw, Urges Immediate Upgrades

·3 views

GitLab released a critical patch on October 21, 2026, fixing CVE-2026-110264, an integer overflow in its regular expression compiler rated CVSS 10.0. Under certain conditions, the flaw could let an unauthenticated user execute arbitrary code on a self-managed GitLab server. It affects self-managed CE and EE releases dating back to version 7.0, while GitLab.com is already patched. Backports are available for several branches from 18.11 through 19.5, and a separate October 12 patch does not cover this flaw. Self-managed administrators are advised to upgrade promptly to the fixed release for their branch.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Quantized FP8 vs Dense Weights for Autonomous Coding Agents: Deep Dive & Engineering Breakdown

Liquid syntax error: Unknown tag 'endraw'

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Matting evaluation shows region and normalization choices can shift MSE more than sixfold

A small matting evaluation on a 90-frame synthetic clip found that the choice of measurement region changed one matte's MSE from 1.41 to 9.03. The author argues that reports must state the region each metric covers, how it is normalized, and where the ground truth came from. Band-only reporting also hid over half of a chroma key's error, which sat outside the edge band. A control with pure flicker scored best on whole-frame dtSSD because its noise was diluted by the full-frame divisor. The author also notes unit scaling differences between raw JSON and the table, and that the dtSSD code was written from memory and not yet verified.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Argo CD 3.5 upgrade: what ops teams moving from 3.x should prepare for

A platform team running Argo CD 3.2 or 3.3 with a few hundred Applications needs to upgrade to 3.5 before an upcoming audit. The release came out in August 2026, and patch releases have since reached 3.5.6, while upstream support covers only the newest minor lines. The article advises treating the upgrade as a managed migration rather than a simple version bump, including backing up state, reviewing upgrade notes for each intervening minor, and rehearsing in a non-production environment. It also flags that ingress-nginx, which was retired in March 2026, should be replaced separately rather than during the same change window. The detailed behavior changes are not reproduced and should be taken from the official Argo CD upgrade documentation and release notes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Chess Engine in C Part 6: How Attacked Squares Are Detected

The sixth installment of a series on building a chess engine in C focuses on detecting attacked squares. An attacked square is one a piece could move to and capture on, regardless of whether a piece currently occupies it. The author explains how each piece's movement pattern is encoded using direction offsets on a 12x10 mailbox board. A SqAttacked function then checks pawns, knights, sliding rooks and queens, bishops and queens, and kings in turn to decide whether a given square is under attack by a specified side.

0 comments Read more at DEV Community