Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

The Hacker News 25 July 2026, 13:14 EEST Security

Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update. Any authenticated user who can push to a project can run it. The attacker commits a crafted Jupyter notebook and opens its commit diff, which leaks a…

Read the full story on The Hacker News https://thehackernews.com/2026/07/researcher-publishes-gitlab-rce-poc.html

Attacks like this land on ordinary sites far more often than on chosen targets. If you would rather your site never became the story, CrockyHost hosting ships with daily backups, automatic updates and a firewall we manage.

Keep reading

The Network Has Become the Control Plane for AI Security The Hacker News
Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts The Hacker News
Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation The Hacker News
Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data The Hacker News