The GitLab Patch Nobody Noticed — Until Exploit Code Went Public
Saturday, July 25, 2026 · 5-minute read
CISA issued a formal advisory this week warning that a Russian state-backed group — tracked as Laundry Bear and Void Blizzard — is combining phishing with a real vulnerability in Zimbra email servers to silently steal emails. The group chains the two techniques together: first a convincing fake email, then an exploit that runs without the victim clicking anything further. CISA's advisory covers organizations of all sizes, so if your workplace runs Zimbra, this is urgent.
↗ CISA Advisory AA26-204ANorth Korean hackers operating under the name BlueNoroff built a convincing fake Zoom platform to lure cryptocurrency holders. Before dropping any malware, the kit quietly checks how much crypto is in a target's wallet — only going after the high-value ones. The initial hook arrives through a compromised contact's Telegram account, making the message look completely legitimate. This is a targeted, patient operation aimed squarely at people with significant digital assets.
↗ The Hacker NewsA hacker used an open-source AI tool called Hermes — running in fully automated "YOLO" mode — to carry out post-exploitation activity inside Thailand's Ministry of Finance network. This is one of the first publicly documented cases of an AI agent running an attack with minimal human direction. It's a sign that breaking into a network may soon require less skill as off-the-shelf AI handles the heavy lifting.
↗ BleepingComputerThe ransomware gang Clop is actively breaking into companies that use PTC Windchill and FlexPLM — software common in manufacturing, automotive, and aerospace industries. No login is needed: attackers chain two flaws together to walk right in, plant hidden web shells, and start siphoning engineering and design files. They then threaten to publish the stolen data unless a ransom is paid. The critical vulnerability involved is CVE-2026-12569, scoring 9.3 out of 10.
Hackers are tampering with DNS settings on Wi-Fi routers at hotels and conference centers. When guests try to visit Microsoft 365, the router silently redirects them to a convincing fake login page that steals their username and password in real time. The attack is especially dangerous because the victim sees a legitimate-looking page and has no obvious sign anything is wrong. Business travelers using hotel Wi-Fi are the primary targets.
Two flaws chained together let an attacker break into Windchill and FlexPLM servers without any login credentials at all. First, one flaw leaks sensitive server information through an exposed endpoint. Then a second flaw in the login system lets attackers run their own code on the server. The result: full remote control, with hidden back-doors planted for ongoing access.
Status: Actively exploited by Clop ransomware gang. Patches and workarounds should be applied immediately. Take internet-facing instances offline if patching is not possible right now.
Any logged-in GitLab user — no admin rights needed — can run commands directly on the server by uploading crafted Jupyter notebooks and exploiting how GitLab renders their previews. Working exploit code was published publicly on July 24. GitLab quietly fixed this on June 10, but buried it in a routine bug-fix note with no security warning — meaning many administrators had no reason to rush the update.
Status: Patch available in the June 10 release. Update your GitLab instance to the latest version immediately. No CVE or public security advisory was issued by GitLab, so this patch may have been missed.
Part of Microsoft's July Patch Tuesday — which fixed a staggering 570 vulnerabilities — this SharePoint flaw lets an attacker elevate their privileges on a Windows system. Microsoft patched it this month alongside two zero-days that were already being used in real attacks. CISA separately urged organizations to harden SharePoint after seeing new exploitations in the wild.
Status: Patch available via Microsoft's July Patch Tuesday update. Apply Windows updates now if your organization hasn't already.
Swiss security firm PRODAFT has published a detailed look at the DevMan Ransomware-as-a-Service portal, which they track internally as "Funky Mantis." The platform functions like a professional SaaS product — affiliates log in to build custom malware payloads, manage victim negotiations via chat, track earnings, and request payouts, all from a single dashboard. Administrators even offer country-specific network access and set strict two-to-three-day deadlines for completing attacks. DevMan emerged in April 2025 and has grown quickly by pulling in experienced affiliates from rival ransomware operations. Understanding how polished these criminal platforms have become helps security teams anticipate what's coming next.
↗ The Hacker NewsA newly discovered piece of malware called Dolphin X includes an AI-powered feature that automatically scores and ranks infected users — essentially prioritizing victims by their likely value to criminals. Once installed, it profiles the machine and its owner, then signals back to the attackers who is worth pursuing further. This kind of automated triage is new territory: rather than attackers manually sifting through thousands of infected machines, the malware does the sorting for them. Security researchers at BleepingComputer flagged this as a notable shift in how criminal tools are being built in the AI era.
↗ BleepingComputerWhen a software company fixes a security flaw, the assumption is that they'll tell you. A security bulletin goes out, a CVE number gets assigned, administrators are alerted, and IT teams prioritize the update. That process broke down completely with GitLab's June 10 release — and this week, working exploit code landed on the internet to prove just how badly.
GitLab patched a serious vulnerability six weeks ago that lets any authenticated user — not just admins, not just developers with special access, but any logged-in account — run commands directly on the server. The fix was real and it worked. But GitLab listed it quietly under "bug fixes," tucked in alongside routine improvements to a JSON parsing library. No CVE number. No security advisory. No CVSS score. No mention of Jupyter notebooks or what the actual risk was. To any administrator doing their job — checking the security section of patch notes before deciding how urgently to update — this looked like ordinary maintenance.
On July 24, security researchers at depthfirst published full working exploit code. The attack is clever and elegant in a troubling way. An attacker commits a specially crafted Jupyter notebook to any project they have access to, then opens the commit preview. That preview leaks a small piece of information about how the server's memory is arranged — a heap pointer. Repeat that a few times with an automated script, and you can map out enough of the server's memory to know exactly where to aim your payload. Two more crafted notebooks, and you have remote code execution. No administrator interaction. No special permissions. No access to other users' projects needed — just a valid login.
This matters beyond just GitLab. The broader lesson is about how companies communicate risk. Security teams at understaffed organizations have limited time and triage ruthlessly. A patch with no CVE, no severity score, and no security label will almost always lose to patches that are clearly marked urgent. When vendors obscure the nature of a fix — whether deliberately or carelessly — they shift the risk entirely onto their customers. If you run a self-managed GitLab instance, update it now. But more broadly, this is a reminder to update software even when patches look boring, because sometimes the most dangerous fixes are the ones nobody notices.