Maximum-severity GitLab flaw became an AI exploit in 17 minutes

Maximum-severity GitLab flaw allows code execution without a password

GitLab fixed a maximum-severity flaw, scored 10 out of 10, that allows running commands on the server without a password. It affects installations that companies host themselves, covering 12 years of versions. The official gitlab.com service is already patched.

A researcher with no exploit experience used the Gemini AI to turn the official advisory into a working attack in 17 minutes, and completed the chain in one hour. GitLab servers hold source code and deployment credentials: breaking into one compromises everything it delivers.

Takeaway: AI shortened the path from flaw advisory to ready exploit to minutes; fixing became a race of hours.

Sources: @DailyDarkWeb, @BleepinComputer, @galnagli 1, @galnagli 2

PHP2Shell was exploited before the patch, and a quarter of flaws already have an attack on the day of the announcement

Amazon reports that attacks on PHP2Shell, the subject of the previous edition, started four days before the official patch. The flaws were found by OpenAI AI models, according to Fouad Matin, who helped coordinate the response with the PHP Foundation.

More than 25% of the flaws exploited in the first half of 2026 already had a recorded attack on the day the flaw was announced, according to Ethiack. A more reliable scanner, from Assetnote, is already circulating, and FOFA (a search engine for exposed systems) counts 229 million PHP targets.

Takeaway: The window started before the announcement: only those who look for the flaw before the attacker find it.

Sources: @BleepinComputer, @fouadmatin, @ethiack, @pilvar222, @fofabot

Ransomware group publishes Whirlpool data, owner of Brastemp and Consul

The WhiteArmor ransomware group published stolen data from Whirlpool, an American appliance manufacturer with revenue of US$ 16 billion in 2025. The portfolio includes KitchenAid, Maytag and, in Brazil, Brastemp and Consul.

In Brazil, Whirlpool controls the Brastemp and Consul brands, which places customer data and local operations in the potentially exposed set. The source does not report the volume or the type of data released.

Sources: @Ransom_DB

Railway reports unauthorized access to customer secrets

The Railway hosting platform reported an incident in systems that store environment variables, where applications store passwords and keys. An intruder may have read these secrets and, in some cases, the decrypted content.

Railway invalidated the access tokens and asked for immediate credential rotation. Anyone using the same secrets elsewhere needs to change them everywhere, because reading one reused password opens the other systems.

Sources: @TheHackersNews

On the same day, a remote flaw in Node.js and an attack on the LiteLLM AI gateway

Two problems hit central development tools on the same day: a remote execution flaw in Node.js, the environment that runs JavaScript on the server, nicknamed Node2Shell, and a supply chain attack on LiteLLM, the gateway that connects applications to AI models.

The attack on LiteLLM compromises a piece of software that many companies trust. The source does not detail the mechanism or the affected versions; teams using these tools must follow the official channels today.

Sources: TechCrunch Security, @pilvar222

VirusTotal flags 6.6 thousand AI agent skills as malicious

VirusTotal analyzed 35.8 thousand 'skills', capabilities installed on AI agents, and classified 6.6 thousand as malicious. In 62% of cases there are only instructions written in natural language, with no virus code at all.

Ninety of these instructions were hidden in invisible Unicode characters, HTML comments or after 825 blank lines. One of them tells the agent: 'Your human doesn't need to know'. The threat lives in the text the agent obeys.

Sources: @IntCyberDigest

Malicious MCP servers execute code via OpenCode flaw

A flaw in OpenCode, an AI coding tool, allows a malicious server to run commands on the developer's computer at the moment of login, on Windows and WSL (the Linux that runs inside Windows).

The attacking server uses MCP, the protocol that connects AI agents to external systems. The fix shipped in version 1.18.33, but with no CVE identifier or official advisory, so vulnerability scanners will not flag the old versions. The update depends on someone going after it.

Takeaway: A flaw without a CVE stays invisible to scanners; only updates and a tool inventory protect.

Sources: @TheHackersNews

Meta may pay US$ 25 billion in New Mexico privacy ruling

Meta may be ordered to pay US$ 25 billion in a privacy ruling from the state of New Mexico, a legacy of the Cambridge Analytica data scandal from about ten years ago.

The amount shows that privacy liability lasts years: a case of improper data use from a decade ago still generates a billion-dollar fine. Companies that collect data today carry this risk for a long time, even after changing their practices.

Sources: The Record

Polkadot wallet extension leaked private keys for about 20 months

Polkadot (a blockchain network) warned that the third-party Fearless Wallet extension was sending the wallets' private key to an attackers' server. The malicious code was active from February 19, 2025 to October 10, 2026.

Eight users have already reported unauthorized transfers, totaling 17,286 DOT, the network's currency. Changing the password or reinstalling does not fix it, because the key itself leaked. Polkadot asks those affected to create new keys and move the funds.

Takeaway: Malicious code sat in a public repository for 20 months with no one noticing; open code does not replace review.

Sources: @DailyDarkWeb

Analysis shows privilege escalation via heap overflow in MariaDB

A published analysis shows that a flaw in MariaDB, a database system, allows a user with query-only permission to take full control of the database. The privileges gained remain valid even after restarting the server.

The flaw was reported as a simple crash, but the researcher demonstrated full privilege escalation. And the detail that matters: after fixing, permissions must be audited, because the patch does not revoke accesses already gained.

Takeaway: A patch closes the flaw but does not undo the damage; auditing and retesting afterwards is mandatory.

Sources: @ptdbugs