devops-security

3 articles · newest first

Close-up of a developer's hands typing code on a laptop keyboard

a single request, no login, no clicks — and your public GitLab repo is gone

GitLab's emergency patch fixes a code-injection bug that let an unauthenticated attacker delete repositories, forge merge records, or ban maintainers in one HTTP request — and researchers reproduced it within minutes of the advisory going live.

Priya Nair · 1d ago · 6 min

A developer terminal displaying a git repository, representing self-hosted Gitea instances affected by CVE-2026-59774

Software

self-hosting Gitea? a stranger can read your server's secrets without logging in — patch today

A single #+INCLUDE line in a Gitea markup preview is enough for an anonymous visitor to pull your server's config file straight off disk, and from there, the path to running their own code is depressingly short.

Priya Nair · Aug 6 · 7 min

A developer's screen showing a git diff and terminal window side by side

Software

your newest Gitea contributor might already have a shell on your server

A patch, a diff, and a Git hook was all it took — no admin access required, and Gitea's own advisory shipped with working exploit code attached.

Priya Nair · Aug 3 · 6 min