GitLab CVSS 10.0 flaw targeted on Alpine Linux server; Ivanti, LiteLLM and UAT-6275 also reported
CRITICAL · VULNERABILITYAlpine Linuxredteam/daily · 12 sources
- Severity
- Critical
- Highest CVSS
- 8.8
- Exploited
- Yes
- Sources
- 12
What happened
Attempted exploitation of GitLab CVE-2026-97229 (CVSS 10.0, unauthenticated code execution via CI/CD configuration validation) hit Alpine Linux's own server a week after the fix; Alpine found no evidence it worked. Other exploited flaws reported: Ivanti Connect Secure CVE-2026-104935 (in CISA KEV), Windows Shell CVE-2026-96951, and BeyondTrust Remote Support CVE-2026-102764 (26.2.3 and earlier, CVSS 9.3). LiteLLM CVE-2026-35029 and CVE-2026-59823 were fixed in 1.83.9. UAT-6275 uses WinRAR CVE-2025-8088; patch archive tools and watch PowerShell, GitHub downloads, scheduled tasks and Startup folder changes.
For security analysts · Written by AI from 12 sources · Wrong?
What to do
- Update Microsoft Windows Server 2016 to 10.0.14393.9612 or later (fixes CVE-2026-96951).
- Update Microsoft Windows 10 1607 to 10.0.14393.9612 or later (fixes CVE-2026-96951).
- CVE-2026-96951 is being exploited: treat it as urgent.
- CISA’s required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or…
Based on advisory data
Vulnerabilities
Full story timeline · 26 updates
- Tue 8 SeptemberThe September 2026 Security Update ReviewZero Day Initiative Blog
- Tue 13 OctoberCVE-2026-96951 added to CISA’s exploited listCISA KEV
- CVE-2026-104935 added to CISA’s exploited listCISA KEV
- When LLM Gateways Go Wrong: Findings from LiteLLMCheck Point Research
- A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-DaysVolexity
- Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)Rapid7 Blog
- CVE-2026-96951 published, CVSS 8.8NVD
- The October 2026 Security Update ReviewZero Day Initiative Blog
- Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilitiesCisco Talos
- Microsoft Patch Tuesday, October 2026 Security Update ReviewQualys Threat Research
- Patch Tuesday - October 2026Rapid7 Blog
- Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)Tenable Blog
- Wed 14 OctoberMicrosoft Patches More Than 1,400 Security FlawsKrebs on Security
- Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizationsCisco Talos
- Thu 15 OctoberThe Q3 Vulnerability Pulse: Discovery ≠ ExploitationCisco Talos
- Fri 16 OctoberCVE-2026-102764 added to CISA’s exploited listCISA KEV
- Mon 19 OctoberCVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildRapid7 Blog
- 19th October – Threat Intelligence ReportCheck Point Research
- Thu 29 OctoberAttacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left OpenThe Hacker News
- GitLab security advisory (AV26-1028) - Update 1Canadian Centre for Cyber Security
- Fri 30 OctoberCISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEVThe Hacker News
- Ivanti Connect Secure 0-Days Exploited in the Wild to Gain Unauthenticated Root AccessCyber Security News
- Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)Rapid7 Blog
- Ivanti security advisory (AV26-1035) - Update 2Canadian Centre for Cyber Security
- Sat 31 OctoberAttackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root AccessThe Hacker News
- U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs
Who reported · 12 outlets
Zero Day Initiative BlogCheck Point ResearchVolexityRapid7 BlogCisco TalosQualys Threat ResearchTenable BlogKrebs on SecurityThe Hacker NewsCanadian Centre for Cyber SecurityCyber Security NewsSecurity Affairs
Who and what is in it
Threat actors