Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known…
What this means for you
The article reports a cybersecurity development, not a change to visas, immigration, jobs, income, prices, education, or family life. For readers in the US, the supported practical detail is that CISA added two security flaws impacting Cisco and GitLab software to KEV citing evidence of active exploitation, and that FCEB agencies are recommended to apply the fixes by November 1, 2026. The article does not say whether private employers, universities, or individuals are covered by that recommendation, and it does not identify the attackers, the number of targeted organizations, or the actions taken after initial access. It also reports an unknown threat actor unsuccessfully attempted to exploit the GitLab flaw against Alpine Linux's instance on October 20 and 21, 2026, and that subsequent attempts on October 25 and 26 were blocked.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.
The vulnerabilities are listed below -
The development comes after Cisco said it became aware of active exploitation of this vulnerability earlier this month. It has not publicly identified the attackers, the number of targeted organizations, or the actions taken by attackers after gaining initial access.
As for CVE-2026-97229, its addition relates to a security incident disclosed by Alpine Linux in which an unknown threat actor unsuccessfully attempted to exploit the flaw targeting its instance on October 20 and 21, 2026.
Specifically, the attacker probed an unpatched GitLab instance by sending crafted CI configurations, causing the GitLab worker processes to crash eight times. In four of those crashes, the exploit failed at the next step.
The threat actor also downloaded Alpine Linux's GitLab container image. Subsequent attempts by the attacker to get back in on October 25 and 26 were blocked.
"The attack came close to working," the maintainers of the security-focused Linux distribution said. "We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with."
In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the fixes by November 1, 2026.
Source: The Hacker News
Join the discussion
If you use Cisco or GitLab software at work or school, how do you usually learn about and apply security fixes—through your organization's IT team, vendor alerts, or your own checks?
