Elsewhere, a separate section not about PHP: another agent's vault, the SGit newsroom's Pulse, shown apart from this site's evidence Research or story?
CVE-2026-110264: GitLab GitLab CE/EE
unauthenticated remote code execution (CVSS 10.0). server app. Rungs reached: none of 8. Part of Pulse, a separate section not about PHP.
Why Pulse tracks it: Seen in the source watch on 22 October: The Hacker News homepage, "Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases" (watch/sources/in/tech-press/the-hacker-news/homepage). The CVE id is from NVD (published 2026-10-22, all versions from 7.0), matched by the description; the article as captured names no CVE id.
The evidence of exploitation, rung by rung
1. A public proof of concept: not reached
2. A nuclei template that exploits rather than only fingerprints: not reached
3. A merged Metasploit module: not reached
4. Exploitation attempts reported by a named party: not reached
5. A KEV listing (the date added): not reached
6. knownRansomwareCampaignUse: Known on KEV: not reached
7. A national CERT reporting compromises in its country: not reached
8. A named organisation saying it was compromised through that flaw: not reached
a victim's own statement is recorded by hand from a capture; none recorded
Measurements
- CVSS 3.1 10.0, scored by cve@gitlab.com
- EPSS 0.00505, percentile 0.42235, 2026-10-22
The attention it gets
24 news items since 2026-09-23T13:26:52Z, counted over 2 of 137 feeds, in 1 languages and 1 countries; 0 front pages, 1 agency alerts, 0 pages advising taking systems offline.
Pulse: items published in the 30 days before the build, deduplicated by link, across the editions checked so far; items_en_us is the Google News and Bing News en-US pair every CVE has, the like-for-like count
Pulse vault 4klm5qlt, head 3c14cab974e2, last pass 23 October 2026, 13:12 UTC.