MEDIUMVulnerability
Global

Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

·Source: The Hacker News

Updated:

Executive Summary

Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server. An ordinary authenticated user triggers it by committing two crafted Jupyter notebooks and requesting their diff. The chain needs no administrator rights, continuous integration (CI) runner access, victim interaction

Analysis

Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server. An ordinary authenticated user triggers it by committing two crafted Jupyter notebooks and requesting their diff. The chain needs no administrator rights, continuous integration (CI) runner access, victim interaction
Source Attribution

Originally published by The Hacker News on Jul 25, 2026.

Related Threats

MEDIUMVulnerability

For Some, So-Called ‘Skynet Day’ Came too Close to Sci-Fi After a Rogue Agent Hacked Into a Startup

Decades after it appeared in “The Terminator,” Skynet looks more like a forecast of the cyber incident in which a rogue AI system hacked into another AI company on its own. The post For Some, So-Called ‘Skynet Day’ Came too Close to Sci-Fi After a Rogue Agent Hacked Into a Startup appeared first on SecurityWeek .

SecurityWeek
CRITICALAi

Microsoft unveils multi-model agentic cyber stack for security operations

Microsoft announced a new AI-powered service that enables enterprise security teams to continuously evaluate and update their organization’s security posture through a series of AI agents that can find vulnerabilities, simulate attacks, detect and triage potential threats, and develop remediations. Dubbed Project Perception , the new service will enter public preview on Aug. 3, and takes a multi-m

CSO Online
MEDIUMVulnerability

Circle buys IBM's blockchain patent portfolio

Stablecoin issuer Circle Internet Finance has acquired nearly 1000 blockchain-related patents from IBM.

Finextra