CVE-2026-110264 is an integer overflow in the regular-expression compiler that could let an anonymous user run code on the server. The fix landed in 19.5.1 and back-ports down to 18.11.13. Self-managed instances should upgrade now.
GitLab
Microsoft says the attackers stole credentials from ConnectWise's cloud backup service and used them to reach customers' Microsoft-hosted mail and files. Agents built on the open-source ARTEX framework drove nearly 3,000 sign-ins a minute against about 2,250 organisations.
TechCrunch
Amazon's MadPot honeypots logged exploitation attempts from October 17. Proof-of-concept code circulated from about 02:00 UTC on October 21, and attacks went wide after the 14:00 release. Anyone who patched on release day may already have been hit.
AWS Security Blog