InfoSecBulletin Cybersecurity for mankind
GitLab patches six vulnerabilities in Community Edition (CE) and Enterprise Edition (EE), with versions 18.2.1, 18.1.3, and 18.0.5 now ready for deployment.
The release addresses six security vulnerabilities, including two serious cross-site scripting (XSS) issues that threaten Kubernetes proxy functionality.
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
These patches address vulnerabilities found in GitLab’s HackerOne bug bounty program. Immediate action is highly advised for all self-managed installations.
Kubernetes Proxy Vulnerabilities:
This patch cycle addresses the most critical vulnerabilities, specifically targeting cross-site scripting attacks that exploit GitLab’s Kubernetes proxy functionality.
CVE-2025-4700, with a CVSS score of 8.7, impacts the Kubernetes proxy feature and may let authenticated attackers cause unintended content rendering, resulting in XSS in certain situations.
The vulnerability impacts all GitLab CE/EE versions from 15.10 before the current patches.
CVE-2025-4439 also tackles a related XSS vulnerability that specifically impacts instances delivered via content delivery networks (CDNs), assigned a CVSS score of 7.7.
The security researcher joaxcar identified both vulnerabilities via the HackerOne platform, underscoring the success of GitLab’s bug bounty program in uncovering significant security issues.
Information Disclosure and Access Control Issues:
Four medium-severity vulnerabilities complete the security patch roster, each carrying CVSS scores of 4.3.
CVE-2025-7001 reveals a sensitive information leak via resource_group API access. CVE-2025-4976 corrects access control issues for internal notes in GitLab Duo responses for Enterprise Edition users.
CVE-2025-0765 and CVE-2025-1299 fix problems with unauthorized access to service desk emails and deployment job logs.
These vulnerabilities show the thorough security review by GitLab’s team, with researchers iamgk808, rogerace, and pwnie responsibly disclosing their findings.
GitLab urges all users to upgrade to the latest patch versions immediately, noting that GitLab.com is already using these versions, while GitLab Dedicated customers do not need to take any action.
