Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

GitLab released fixes on October 21 for a flaw, tracked as CVE-2026-110264 and rated CVSS 10.0, that could let an unauthenticated attacker run code on a self-managed server, The Hacker News reports. The flaw is an integer overflow in the regular expression compiler and affects every version going back to 7.0, released in 2014.