TL;DR On October 23, 2026, the Ruby team shipped a Ruby security update in versions 4.0.9, 3.4.12 and 3.3.13. The releases fix memory bugs in Onigmo, Ruby's regular expression engine. GitLab had found that these bugs allowed remote code execution on its servers and assigned four CVEs to them. Why It Matters GitLab already patched the Ruby it ships. However, any other Ruby app that compiles user-supplied patterns faces the same risk.

TL;DR On September 23, 2026, developers launched a GitLab critical patch release fixing 11 security flaws. The most dangerous defects allow authenticated users to trigger a GitLab RCE vulnerability through malformed regular expressions. Administrators running self-managed instances must install version 19.4.1, 19.3.3, or 19.2.7 immediately. Why It Matters Market estimates show that millions of developers utilize GitLab to host proprietary source code.