https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving GitLab.Sun, 26 Jul 2026 22:32:51 GMThttps://thehackernews.com/2026/07/researcher-publishes-gitlab-rce-poc.htmlcst-3209A researcher released a working proof-of-concept exploit for an unpatched GitLab vulnerability (CVE-18.11.3) that allows authenticated users to execute arbitrary commands with git privileges. The attack requires only two malicious Jupyter notebook commits and a diff request, with no need for administrator rights or CI runner access.Sat, 25 Jul 2026 08:34:15 GMThttps://doublepulsar.com/microsofts-stance-on-zero-day-exploits-is-a-dumpster-fire-of-their-own-making-0946117940a4?source=rss----8343faddf0ec---4cst-585A researcher going by Nightmare Eclipse has published proof of concept exploits for Microsoft vulnerabilities, claiming difficulty in responsible disclosure. Microsoft responded by disabling their MSRC account, removing exploits from GitHub, and characterizing the activity as potentially criminal. The situation highlights tensions between coordinated disclosure frameworks and researcher access to reporting mechanisms, complicated by Microsoft's historical hiring of security researchers who have publicly disclosed exploits.Thu, 28 May 2026 13:44:27 GMThttps://elastic.co/security-labs/detecting-cicd-pipeline-abuse-with-llm-augmented-analysiscst-630Attackers are increasingly targeting CI/CD pipelines rather than production systems directly, compromising developer credentials and modifying workflow files to exfiltrate secrets at scale. The article details specific attack patterns including the GhostAction campaign (327 users, 3,325 stolen secrets), the Shai-Hulud npm worm (46,000 malicious packages), and automated scanning for misconfigurations like the pull_request_target trigger. A new open-source tool, cicd-abuse-detector, has been released to identify suspicious pipeline modifications across GitHub Actions, GitLab CI, and Azure DevOps using regex patterns and language model analysis.Wed, 29 Apr 2026 00:00:00 GMThttps://wiz.io/blog/wiz-code-unify-security-across-github-gitlab-and-azure-reposcst-1571Wiz has released a security solution that provides visibility and control across code repositories on GitHub, GitLab, and Azure Repos. The offering integrates configuration checks and code scanning capabilities to secure development pipelines.Thu, 18 Jul 2024 14:47:16 GMT