Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
The Hacker News 23.10.2026 17:54
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month.
GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers.
Ruby says any
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
The Hacker News 23.10.2026 13:50
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.
"Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,
php2shell: Millionen PHP-Dienste in Deutschland verwundbar
Heise Security 23.10.2026 12:03
Die IT-Sicherheitsfirma Censys scannt PHP-Server auf für php2shell anfällige Versionen. Millionen in Deutschland sind noch verwundbar.
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
The Hacker News 23.10.2026 09:36
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open.
The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.
Cisco stopft diverse, teils kritische Sicherheitslücken
Heise Security 23.10.2026 08:10
In mehreren Produkten von Cisco klaffen teils kritische Lücken. Der Hersteller stellt Sicherheitsupdates bereit.
Schadcode-Attacken möglich: 12 Jahre alte Lücke gefährdet Gitlab-Server
Golem 23.10.2026 06:59
Administratoren sollten dringend ihre Gitlab-Instanzen aktualisieren. Eine seit 2014 bestehende Lücke lässt Angreifer eigenen Code einschleusen. (Sicherheitslücke, Server)