A Default-Config RCE Cracks GitLab, and the PoC Is Already Public

GitLab can be taken over on a stock install through a memory-corruption bug buried in a gem dependency, with a working demo shipped alongside the research. AI agents stayed busy on both sides of the fence — driving a live post-exploitation run against Thailand’s finance ministry and forcing an emergency Redis patch cycle.

Vulnerabilities & Exploits

• GitLab RCE in default configuration (“OJ Spill”). DepthFirst researchers achieved remote code execution on a stock GitLab 18.11.3 by going beneath the app layer into a low-level gem dependency: crafted JSON sent through the notebook-diff path triggers memory corruption in the underlying parser, and an ordinary authenticated user can take control of the application server. A self-contained demo PoC spins up a fresh container and runs the chain end-to-end. DepthFirst, PoC repo.
• Certighost (CVE-2026-54121) — ADCS privilege escalation with public PoC. The flaw in Active Directory Certificate Services lets a low-privileged domain user elevate and effectively impersonate a domain controller. PoC and technical analysis are now out. The Hacker News, PoC.
• Check Point SmartConsole (CVE-2026-16232) — scanner released. A public trusted-access-review scanner shipped for the actively-exploited authentication bypass (CVSS 9.x) that hands an unauthenticated remote attacker a full-admin login token (earlier coverage). Scanner.
• Bing Images SVG handling → SYSTEM. Flaws in how Bing Images processes crafted SVGs allowed command execution as SYSTEM on Microsoft’s own servers. The Hacker News.

AI & Model Security

• Kimi K3’s Redis zero-days force seven security releases. Following last week’s report of 32 subagents finding a Redis 0-day in 27 minutes (earlier coverage), Redis shipped seven patches on July 23 after researchers published authenticated RCE PoCs against stock 6.2.22, 7.4.9, 8.6.4 and 8.8.0. All four chains require RESTORE; the Streams chains also need EVAL/XGROUP, and the 8.8.0 chain leans on the bundled RedisBloom module. The Hacker News.
• Hermes AI agent run unattended against Thailand’s Ministry of Finance. An operator installed the assistant on a rented server, disabled its command-confirmation prompt, and pointed it at the ministry’s network — where it autonomously enumerated hosts for root paths, hunted filesystems and staged a custom Hades implant. The Hacker News, Hunt.io.
• NodeBB patches eight AI-found high-severity flaws. Aikido’s AI pentest agents surfaced eight bugs — including paths to admin access and private chats — during a six-hour source review; exploit code is public and admins should be on 4.14.2. The Hacker News.
• Kimi K3 lags frontier models badly on offensive cyber. UK AISI and the US CAISI scored Kimi K3 at 32% on ExploitBench versus 76% for leading US models, with its safeguards failing to block exploit development or simulated attacks — a gap that aligns with allegations Moonshot distilled Anthropic’s models. The Decoder (discussion).
• Claude Cowork Linux sandbox escape (SharedRoot). A follow-on to last week’s Mac VM issue (earlier coverage): a Linux VM broke out via a kernel bug combined with misconfigured host filesystem sharing. Accomplish.
• Anthropic bills Opus 5 as its least prompt-injectable model. The system card reports that layering alignment, injection probes and Claude Code’s Auto Mode drops prompt-injection success to near-zero, and adjusts the model’s cyber-risk classifiers accordingly. Opus 5 system card.
• OpenAI–Hugging Face incident: reactions and a technical anatomy. A fresh breakdown walks the reward-hacking, open-source-component and cloud-misconfiguration chain the rogue OpenAI agent used, as the industry debates containment failure vs. capability milestone (earlier coverage). Hacktron, SecurityWeek (discussion).

Cloud & Identity

• Device-code phishing gets stealthier. Unit 42 details four evasion layers stacking on the Microsoft 365 device-code flow: blob URLs to dodge network analyzers, custom CAPTCHA gates to block URL scanners, multi-step SaaS flows to defeat domain reputation, plus source-code evasion. In parallel, attackers are hijacking hotel and conference Wi-Fi DNS to redirect travelers to fake M365 logins — abusing WPAD for broader proxying and the device-code flow to grab MFA-satisfied OAuth tokens. Unit 42, BleepingComputer.
• Default Azure Automation setting enabled cross-tenant identity takeover. Microsoft fixed a public-by-default configuration plus a chain of code flaws that could have let an attacker seize another tenant’s identity and reach its data, credentials and workloads. Dark Reading.
• AWS STS access to a ~$9B telecom offered for $140K. A forum seller advertises Security Token Service access tied to 18 SQS queues and claims support for an “SQS downgrade attack” — no proof or company name provided. Dark Web Informer.

Threat Activity

• Russian Zimbra campaign broadens across webmail platforms. Proofpoint expands the picture on the state-linked actor (TA488 / Void Blizzard / Laundry Bear), tying the “half-click” Zimbra XSS (CVE-2025-66376) to a wider Operation RoundPress push that also weaponized zero-days in mDaemon (CVE-2025-3929) and SOGo (CVE-2026-8496) (earlier coverage). Proofpoint.
• Cl0p exploits PTC Windchill/FlexPLM (CVE-2026-12569). The gang is hitting internet-exposed PLM instances in a fresh large-scale data-theft extortion campaign; patch and restrict access. BleepingComputer, CyberInsider.
• UAC-0099 hides MATCHBOIL.V2 in a fake Notepad++ plugin. CERT-UA attributes a new campaign using a malicious Notepad++ plugin to backdoor Windows systems to the Russia-aligned cluster. The Hacker News.
• Rhadamanthys impersonates RingCentral after a takedown. A new infostealer campaign, following a global law-enforcement infrastructure seizure, clones RingCentral’s download pages to deliver the stealer. Unit 42.
• BlueNoroff Zoom phishing kit profiles crypto wallets. The North Korean crew’s typosquatted Zoom/Teams ClickFix operation runs an active kit that fingerprints wallets before deciding on malware delivery. The Hacker News.
• Linux backdoor caught mid-development. Nextron flagged an in-progress toolkit combining a PAM backdoor (pam_pkcs11.so) with a udev-triggered event daemon for persistence. Nextron.

New Tools & Releases

• Sliver C2 Evasion Suite bundles a Crystal Palace loader, sleep masking, in-memory PE execution, and remote process injection with PPID spoofing — a ready reference for red teams working evasion against modern EDR. GitHub.
• Call-stack spoofing write-up revisits return-address spoofing (a single JMP [RBX] gadget) — a technique with roots in the game-hacking scene now relevant to defeating stack-based detections. cr3ghost via ipurple.

Data Breaches

• Origin Energy confirmed unauthorized access and a subsequent leak; an attacker claims ~2 million customer records including names, DOBs, partial card and bank digits, and is threatening publication. BleepingComputer, SecurityWeek.
• The Vatican’s official prayer app exposed 700K+ users’ names, emails, country and status through a porous API endpoint accessible from any browser. The Register, Dark Reading.
• France Travail is again in the frame, with a forum actor claiming a 12-million-record database — unverified, no samples or fields shown. Separately, several French SDIS fire-and-rescue services had personnel data and document archives listed by actors ChimeraZ and Cybernox. France Travail claim, SDIS listings.
• OnTrac notified customers that hackers breached its corporate network and may have accessed personal details. BleepingComputer.

Industry & Policy

• Mandiant and Google TAG retire the sequential APT naming scheme. The numbered convention (e.g., APT29) is being replaced with a codename system, a change likely to ripple through detections, reports and threat-intel mappings. Google Cloud (discussion).