Log4Shell

GitLab Discloses 12-Year-Old CVSS 10.0 Vulnerability Enabling Unauthenticated Remote Code Execution

GitLab has published a critical security advisory for CVE-2026-110264, a CVSS 10.0 flaw that permits unauthenticated remote code execution on both Community and Enterprise self-hosted instances. The vulnerability has existed in the codebase since 2014 and affects every version up to the latest release prior to the October 2026 patch. Exploitation requires no credentials or special conditions, allowing attackers to run arbitrary commands, exfiltrate source code, deploy backdoors, or move laterally. The issue remained undetected through multiple code iterations, security audits, and version updates due to its hidden trigger conditions within the large, complex application. Organizations are urged to immediately verify their version, review access logs for anomalies, and apply the official fix, while temporary mitigations include network restrictions and enhanced monitoring.

NVD Disruptions Force Security Teams to Diversify Vulnerability Intelligence Sources

The vulnerability management ecosystem has undergone major shifts over the past two years, undermining reliance on a single authoritative database. NVD, long considered the central enrichment layer for CVE records, has experienced significant operational problems that affect timeliness and completeness of data. Russian organizations are increasingly turning to BDU FSTEC as the national vulnerability database that provides official descriptions, remediation guidance, and coverage of domestic software. CVE maintained by MITRE continues to serve as the universal identifier standard, yet it lacks the detailed scoring and product mappings previously supplied by NVD. Vendor security bulletins from Microsoft, Cisco, Astra Group, and Positive Technologies often deliver the earliest and most accurate information. The article explains why a multi-source approach has become essential for comprehensive vulnerability management programs.

What Is an Exploit: How a Flaw in Someone Else's Code Becomes Unauthorized Access to Your Server

The article explains the critical distinction between a vulnerability and an exploit using the Log4Shell incident as the primary example. It breaks down how Log4j's JNDI lookup flaw allowed remote code execution simply by logging a crafted string, leading to CVE-2021-44228 with a maximum CVSS score. The piece covers the full lifecycle from vulnerability discovery to payload delivery, including memory corruption, injection flaws, and logical errors. It details defensive mechanisms such as stack canaries, DEP, ASLR, and CFG, along with attacker responses like ROP chains. Real-world cases including Zerologon, Heartbleed, Stuxnet, and WannaCry illustrate the progression from single bugs to multi-stage exploit chains. The text also addresses zero-day economics, exploit kits, bug bounty programs, and practical mitigation strategies centered on KEV catalogs and EPSS scoring.