August 18, 2026
Three Fast-Moving Flaws Put GitLab and AI Infrastructure on Alert
GitLab CVE-2026-19478 enables unauthenticated deletion of public projects through a critical GraphQL code-injection flaw affecting self-managed instances. MLflow CVE-2026-64849, an unauthenticated SSRF, was exploited within hours of disclosure to extract cloud credentials from hosted deployments. CISA added actively exploited Ray CVE-2025-62593 to its Known Exploited Vulnerabilities catalog; the flaw enables RCE through DNS rebinding on unauthenticated job-submission interfaces. Anthropic and EPFL researchers demonstrated self-propagating "mind viruses" that spread between AI agents via persistent prompt files, while Penn State found that context compression causes AI systems to discard an average of 83% of user safety restrictions.