ICHI Global Five Minute Cyber Rundown
GitLab CVSS 10 flaw in CISA KEV where upgrading GitLab alone does not fix own-Ruby installs, actively exploited Drupal Commerce bypass, PeopleSoft's one CVE hiding three chained flaws, plus Cisco KEV and TeamViewer updates.
Listen to this episode
MP3, 2.3 MB · · the full transcript is below.
Show notes
ICHI Global Five Minute Cyber Rundown — Friday, October 30, 2026
The day's theme is patching traps: a maximum-severity flaw that an application upgrade alone does not fix, an actively exploited store module, and a PeopleSoft chain where one CVE hid three flaws.
Most important development — GitLab CVE-2026-97229 (CVSS 10.0), KEV due November 1
CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29, 2026, with a federal remediation deadline of November 1, 2026. The integer-overflow flaw is in Onigmo, Ruby's regular-expression engine, and a crafted regular expression in a CI/CD configuration can allow unauthenticated remote code execution on GitLab Community and Enterprise servers. GitLab fixed it October 12 in 19.2.8, 19.3.5 and 19.4.2 — by patching the Ruby bundled in its own packages and images.
Alpine Linux disclosed that an attacker targeted its GitLab server on October 20–21, crashing workers eight times and getting partway through the exploit in four attempts; the attacker returned October 25–26 without success. Alpine found no evidence of success but could not rule it out, rebuilt the instance from scratch, and reset all passwords. Alpine's upgrade to GitLab 19.3.6 did not close the hole because its image used standard Ruby. Self-built / own-Ruby installs also need Ruby 3.3.13, 3.4.12 or 4.0.9 or later. CISA notes other products may be affected by the same underlying Ruby/Onigmo issue. A separate GitLab regex flaw, CVE-2026-110264, was fixed October 21 and is not closed by the earlier update alone.
Drupal Commerce Core CVE-2026-118539 — actively exploited
Drupal confirms active exploitation of an access-bypass flaw in Commerce Core (risk 21/25), affecting versions before 8.x-2.41 and 3.x before 3.3.13. The module provides carts and checkout and is used on more than 42,000 sites (usage, not victim count). Drupal says insufficient protection of certain routes and entity fields may financially impact vendors; it has not disclosed attack method, actor, or number of targeted stores. Fix: update to 3.3.13 or 8.x-2.41 and audit orders for inconsistencies.
Updates and patch-now warnings
- Cisco CVE-2026-76418 (CVSS 8.6): covered October 29 as an actively exploited ASA/FTD SSL VPN denial-of-service flaw; it is now also in CISA KEV (added October 29), due November 1. No workaround; upgrade to a fixed release.
- TeamViewer (bulletin TV-2026-1011, October 27): three high-severity flaws up to CVSS 8.8, including CVE-2026-111585 and CVE-2026-92372, where a malicious or compromised host could crash or potentially execute code on the connecting viewer's machine, plus a macOS privilege-escalation flaw (CVE-2026-92374, 7.8). TeamViewer said it was not aware of active exploitation at publication — this is a patch-now warning, not a confirmed attack. Update to version 15.83 or later.
PeopleSoft CVE-2026-35273 was three chained flaws — ZDI analysis
Zero Day Initiative analysis published October 27 says Oracle's June 10 fix for CVE-2026-35273 (CVSS 9.8, PeopleTools 8.61 and 8.62) covers three distinct flaws: an SSRF in the Integration Gateway, a trust bypass because the Environment Management Hub's default allowed-hosts configuration trusts 127.0.0.1, and two alternative routes to remote code execution — a web shell written through a logging/file-path flaw, and a malicious XML file executed by Java XMLDecoder at service start. Mandiant/Google Threat Intelligence attributed May 27–June 9 exploitation, mostly against universities, and a renewed, broader September wave to ShinyHunters (UNC6240); WAF rules blocking the hub path were bypassed by URL-encoding a single character. Defenders should patch, hunt for both code-execution artifacts, treat hosts with a web shell as compromised, and rotate credentials reachable from the PeopleSoft tier.
Defensive implications
- Patch GitLab and its underlying Ruby together; hunt for GitLab worker crashes and hostile CI regexp activity.
- Patch Drupal Commerce Core and audit orders — a patch does not prove a store was not abused earlier.
- Meet the November 1 KEV deadline for GitLab CVE-2026-97229 and Cisco CVE-2026-76418.
- Update TeamViewer to 15.83 before technicians connect to untrusted machines.
- For PeopleSoft, do not rely on WAF rules alone; hunt both the web-shell and XML routes.
Note: ICHI.global's live index score did not render during the pre-production check, so no numeric score is quoted in this episode. Model C scoring refinements remain under development and are not announced here.
Transcript
Akari: The daily cyber rundown, brought to you by ICHI.global. I'm Akari, and this is your five minute rundown for Friday, October thirtieth, twenty twenty-six. The threat picture today is dominated by patching traps. The most urgent flaw was supposedly fixed weeks ago, yet many servers are still open. Akari: Our most important development is a maximum severity flaw in GitLab. On Thursday, the U S Cybersecurity and Infrastructure Security Agency added C V E twenty twenty-six, ninety-seven thousand two hundred twenty-nine to its Known Exploited Vulnerabilities catalog, with a federal remediation deadline of November first. The flaw scores a perfect ten. It sits in Onigmo, the regular expression engine built into Ruby, and a specially crafted regular expression in a C I, C D configuration can let an unauthenticated attacker run code on a GitLab server. Alpine Linux lived this. An attacker targeted its GitLab server on October twentieth and twenty-first, crashing workers eight times and getting partway through the exploit in four of them. Alpine found no evidence the attack succeeded, but it could not rule it out, so it rebuilt the server from scratch and reset every password. Here is the trap. GitLab fixed this on October twelfth by patching the Ruby it bundles in its own packages. Alpine ran GitLab on a standard Ruby, so upgrading GitLab to version nineteen point three point six still left it exposed. If you build GitLab from source or use your own Ruby, upgrading GitLab is not enough. Your Ruby must also reach three point three point thirteen, three point four point twelve, or four point zero point nine, or later. Akari: Next, online stores. Drupal confirms active exploitation of C V E twenty twenty-six, one hundred eighteen thousand five hundred thirty-nine, an access bypass in Commerce Core, the module that adds carts and checkout to Drupal sites and is used on more than forty-two thousand sites. Drupal rates it twenty-one out of twenty-five, says unauthenticated attackers can reach protected routes and fields, and warns it may financially impact vendors. Drupal has not said how many stores were hit. Update to Commerce Core three point three point thirteen, or eight x two point forty-one for older branches, and audit your orders for inconsistencies, because patching does not prove a store was not abused before the fix. Akari: A quick update on yesterday's Cisco story. That firewall denial of service flaw, C V E twenty twenty-six, seventy-six thousand four hundred eighteen, is now also in the Known Exploited Vulnerabilities catalog, likewise due November first. And a caution on TeamViewer. Its October twenty-seventh bulletin fixed three high severity flaws, up to eight point eight, where a malicious host could attack the support technician who connects to it. TeamViewer said it was not aware of exploitation when it published, so treat this as a patch now warning, not a confirmed attack. Update to version fifteen point eighty-three. Akari: For adversary activity, new analysis changes how defenders should hunt in Oracle PeopleSoft. The Zero Day Initiative says the flaw ShinyHunters exploited, C V E twenty twenty-six, thirty-five thousand two hundred seventy-three, scoring nine point eight, was actually three chained flaws, not one. A server side request forgery reaches an internal management hub because it trusts the server's own loopback address by default, and from there attackers have two different routes to code execution, a planted web shell, or a malicious X M L file read at the next service start. Mandiant tied exploitation in May and June, and a renewed wave in September, to ShinyHunters. The lesson is blunt. A web application firewall rule was bypassed by encoding a single character, so patch PeopleTools eight point sixty-one and eight point sixty-two, and hunt for both routes, not just web shells. Akari: So the defensive list is concrete. Fix GitLab and its Ruby together, and check for worker crashes and hostile C I configurations. Patch Drupal Commerce and audit orders. Meet the November first deadline for GitLab and Cisco. Update TeamViewer before technicians connect to untrusted machines. And for PeopleSoft, rotate credentials reachable from that tier. Akari: The takeaway is that a green patch dashboard can lie. What matters is whether the vulnerable component underneath actually changed. For the underlying evidence behind today's stories, visit I C H I dot global. I'm Akari, and I'll see you Monday.
Sources
- The Hacker News — CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV thehackernews.com
- The Hacker News — Attacker Tried to Exploit Alpine Linux's GitLab via CVSS 10.0 Flaw Its Ruby Left Open thehackernews.com
- Cybersecurity News — CISA Warns of GitLab Integer Overflow Vulnerability Exploited in Attacks cybersecuritynews.com
- SecurityWeek — Drupal Commerce Core Vulnerability Exploited Against Online Stores www.securityweek.com
- NeoTeo — Oracle PeopleSoft chained flaws: 3 paths to RCE (ZDI analysis) www.neoteo.com
- Cybersecurity News — TeamViewer Vulnerabilities Could Let Hackers Execute Malicious Code Through Remote Desktop Sessions cybersecuritynews.com
Get ICHI Daily and ICHI Weekly by email
- ICHI Daily: one email on weekdays, after each new daily episode is published (no episode, no email).
- ICHI Weekly: one email on Sundays after 9 p.m. US Eastern time, once the new edition is published. If you choose both the weekly podcast and the written brief, they arrive together in that one email.
No new episode, no email. Every email links to the episode on ICHI; audio is never attached.
All ICHI Daily episodes · ICHI Briefs & Podcasts
ICHI Daily and ICHI Weekly are editorial commentary on ICHI’s evidence. They never change the VECTORS score, incident evidence classifications or intelligence rankings.
ICHI Briefs & Podcasts · ICHI Daily · ICHI Weekly · Episode calendar · ICHI Perspectives · episodes.json · ICHI dashboard · Methodology