CuraSec

tag: Code-Injection · 2 items

Act Active exploitation of critical Gitea code injection flaw confirmed by CISA
2026-08-26 · BleepingComputer · source ↗ #gitea#code-injection#active-exploitation
  • Engineer — Act: If you run a self-hosted Gitea instance, patch to the fixed version immediately — CISA-confirmed active exploitation of a critical code injection flaw means your CI/CD pipeline and source repositories are at direct risk.
  • SOC/IR — Act: Audit any Gitea instances in your estate for signs of code injection compromise dating back to initial disclosure; a compromised source-code host can stage supply-chain attacks that require assume-breach investigation of downstream build artifacts.
  • Leader — Plan: Direct your teams to inventory self-hosted Gitea deployments and validate patch status; a code injection flaw in source-code infrastructure carries supply chain risk worth confirming is closed before it surfaces in a customer security questionnaire.
Act GitLab CVE-2026-19478 Code Injection Actively Exploited Days After Disclosure
2026-08-21 · The Hacker News · source ↗ #gitlab#code-injection#cicd-security
  • Engineer — Act: GitLab is a core CI/CD asset in most engineering environments; this unauthenticated code-injection flaw (CVSS 9.4) with a public PoC is already being weaponized. Patch all self-hosted GitLab instances to the vendor’s fixed version immediately and audit recently modified public projects for unexpected data rewrites.
  • SOC/IR — Act: Active exploitation of a GitLab code-injection flaw means assume-compromise posture for any internet-exposed self-hosted instance: hunt GitLab audit logs for unauthenticated modification or deletion events against public projects since the disclosure date, and alert engineering if anomalies are found.
  • Leader — Plan: A critically-rated, actively exploited flaw in a widely-used CI/CD platform carries supply-chain risk if projects were tampered with before patching; confirm with engineering that all GitLab deployments are patched this week and assess whether any customer-facing build artifacts could have been affected.
  • Signals: CVE-2026-19478 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub