[CVE-2026-19478]

August 24, 2026

• Public labs and safe PoCs shipped for the exploited GitLab flaws — a reproducible environment for CVE-2026-19478 / CVE-2026-19650 (GraphQL @gl_introduced) (GitHub) and a second lab for CVE-2026-10053, the npm package-registry path traversal giving arbitrary file write as git (GitHub). Released on the basis that exploitation is already circulating (earlier coverage). · New Tools & Releases

in Four Days Dark: Iran-Linked Intrusion Knocked a UK Power Plant Offline

August 21, 2026

• GitLab CVE-2026-19478 is now being exploited, days after disclosure — the GraphQL directive code injection lets unauthenticated attackers modify or delete public projects and user data (SecurityWeek), with technical analysis from Horizon3 (earlier coverage). · Exploited in the Wild

in Microsoft's Own Defender Driver Becomes the EDR Killer

August 18, 2026

• GitLab CVE-2026-19478 enables unauthenticated modification or deletion of public projects and user data. The critical GraphQL code-injection flaw affects self-managed GitLab CE and EE, carries a CVSS score of 9.4, and can be triggered with one request under the vulnerable conditions. watchTowr reproduced it within minutes; no public exploit was available at the time. Operators should upgrade or restrict access to /api/graphql, with Dark Reading noting that limited technical detail complicates retrospective detection. The Hacker News has the patch overview. · Vulnerabilities & Exploits

in Three Fast-Moving Flaws Put GitLab and AI Infrastructure on Alert