GitLab fixes critical AI Gateway flaw that could let authenticated Duo users escape a prompt sandbox and execute commands on self-hosted gateways. GitLab has released patches for a critical vulnerability in its AI Gateway, tracked as CVE-2026-90970 (CVSS score of 9.9), that could allow an authenticated user with access to the Duo Agent Platform to execute arbitrary commands on the gateway. GitLab disclosed the flaw on October 2 and fixed it with the release of AI Gateway versions 19.2.4, 19.3.2 and 19.4.1. The issue affects the way the AI Gateway handles custom flow prompt templates. According to GitLab, a user with Duo Agent Platform access could use a specially crafted flow configuration to escape the prompt template sandbox and execute commands on the AI Gateway host. “GitLab has remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway.” reads the advisory. The important point is that the attack does not require an unauthenticated connection. GitLab’s advisory does not provide further details about the exact conditions required to exploit the flaw or the permissions needed beyond that access. GitLab credited the HackerOne researcher invisiblemeerkat with responsibly reporting the vulnerability. The GitLab AI Gateway is basically the middle layer between GitLab Duo and the AI models. GitLab Duo provides AI features such as code suggestions, chat, code explanation and agentic workflows. The AI Gateway receives the requests from GitLab, prepares the prompts and communicates with the underlying LLMs. GitLab operates its own cloud-based gateway, but organizations can also deploy an AI Gateway inside their own infrastructure. GitLab says the security fix has already been deployed to its own hosted AI Gateways. Customers using GitLab.com, GitLab Dedicated, or a GitLab Self-Managed instance connected to a GitLab-hosted gateway therefore do not need to take action. The customers that need to patch are those running a GitLab Self-Hosted AI Gateway. GitLab has already contacted those customers directly and strongly recommends updating affected installations immediately. Self-hosting the gateway is designed for organizations that want to keep AI requests and responses inside their own environment. In a fully self-hosted configuration, GitLab, the AI Gateway and the selected AI models can all operate within the organization’s infrastructure. Below are the affected AI Gateway releases: Affected versionFixed version18.1.6 through 19.2.319.2.419.3.0 through 19.3.119.3.219.4.019.4.1 The AI Gateway sits between GitLab’s AI features and the underlying models. In a self-hosted deployment, it processes requests between the GitLab instance and the organization’s AI infrastructure. The service also has access to sensitive authentication material. GitLab’s installation documentation says that self-hosted deployments require signing and validation keys for JSON Web Tokens. These keys are passed to the gateway as environment variables. For that reason, command execution on the gateway could provide an attacker with a foothold inside infrastructure that handles AI requests and authentication. The exact impacts would depend on how the gateway is deployed and what access it has to the rest of the organization’s environment. GitLab’s October 2 advisory does not say that CVE-2026-90970 has been exploited in the wild. It also does not publish a proof of concept or technical exploitation steps. That leaves several important questions unanswered, including the precise flow configuration needed to escape the template sandbox and the exact conditions under which the resulting command execution can be reached. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances. AI Gateway is a service that gives access to AI-native GitLab Duo features. While GitLab operates its own cloud-based AI Gateway instance used by GitLab.com, GitLab Self-Managed, and GitLab Dedicated, users can also deploy their own self-hosted instances on GitLab Self-Managed through GitLab Duo Self-Hosted. Tracked as CVE-2026-90970, this security flaw stems from an improper neutralization weakness and can let attackers with basic privileges and Duo Agent Platform access execute arbitrary commands on unpatched instances. "GitLab has remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway," the company explained in a Friday advisory.
Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments.
Dell has released security updates to address multiple critical security flaws in Dell Container Storage Modules (CSM) that could be exploited by bad actors to take over susceptible systems. The vulnerabilities are listed below - CVE-2026-63688 (CVSS score: 10.0) - A missing authentication for critical function vulnerability in the csm-authorization-storage gRPC server that an
DOJ charges against Oxygen Forensics reveal the Russian-linked firm also sold forensic software to EU projects and European police forces for years. Last week’s Justice Department indictment of Oxygen Forensics looked, at first, like an American procurement scandal. CEO Lee Reiber and Russian co-founder Oleg Davydov stand accused of hiding that the company was Russian-owned and its software built in Russia, while it sold forensic tools to the Pentagon, the Secret Service, and other US agencies. Politico’s reporting shows the reach went a lot further than Washington. “The CEO of a Virginia-based software company and a Russian national have been arrested on a federal criminal complaint charging them with concealing from U.S. government agencies that their company was owned and controlled by Russian nationals and that its software was developed in Russia, the Justice Department announced today.” DoJ states. “Reiber allegedly represented to the government that the company had no foreign ownership or control and that its software was developed in the United States, when in fact five Russian nationals, including Davydov, owned and controlled the company and its software was developed in Russia.” According to documents reviewed by Politico, Oxygen Forensics was involved in two EU-funded projects designed to improve how European investigators collect and share digital evidence. The first, EVIDENCE, ran from 2014 to 2016 and received more than €1.9 million in EU funding. Oxygen was consulted alongside organizations such as Europol, Eurojust and the European Anti-Fraud Office’s digital forensics unit. The second project, INSPECTr, was funded through Horizon 2020. It developed software that allowed investigators to combine evidence extracted with tools such as Oxygen’s with data from other systems. The project continued until 2023, after Russia’s invasion of Ukraine. “The second project, INSPECTr, backed under Horizon 2020, an EU research and innovation funding arm, was designed to help European police bring together and analyze digital evidence collected using different tools. It built software that could take evidence extracted with Oxygen Forensics and make it easier for investigators using other systems to access and analyze it.” reports POLITICO. “Although both of those EU-backed projects were launched well before Russia’s February 2022 full-scale invasion of Ukraine and subsequent European sanctions, INSEPCTr continued to operate until 2023.” The European Commission said Oxygen was not a formal member of either consortium and did not receive direct EU funding. It also noted that Russian entities have been excluded from Horizon Europe projects since the war began. That may be technically correct, but the issue is broader: Oxygen was still consulted on EU-funded projects dealing with digital evidence and investigative technology, even if it was not officially part of the project or directly funded by the EU. The domestic Russian side of this story is the part that should worry European agencies more than the funding technicality does. The same five people who secretly owned Oxygen Forensics also controlled MKO Systems, a Russian company selling the same underlying technology to the FSB and Russia’s Interior Ministry. That’s not two unrelated businesses that happen to share a founder. That’s one piece of forensic technology with two sets of customers who are, depending on how you look at it, on opposite sides of several ongoing investigations. And the client list in Europe, once you start counting, is long. Police agencies in Germany, Spain, Italy, and Poland accredited or purchased Oxygen’s products, according to EU tender records. Hungary’s police signed a contract worth roughly €27,000 in December 2024, running through the end of last year. A prosecutor’s office in Sardinia listed Oxygen among its recognized mobile-extraction systems as recently as April 2026, and a Spanish National Police inspector accredited by the company co-authored a 2026 study on cracking WhatsApp data on Android and iPhone. Romania and Latvia bought in as recently as this September, days before the arrests. There is also a more worrying case outside the EU. French outlet Disclose reported that Oxygen’s software was provided to Moroccan authorities through an EU-funded border management program covering the Maghreb. The EU also paid for training courses where Oxygen employees trained Moroccan police to use the software. In other words, a tool allegedly controlled by Russian interests was being used to train foreign law enforcement, with the training funded by the EU. Some agencies are now reacting. Romania’s National Anticorruption Directorate told Politico it will stop using Oxygen’s products after the ownership issue became public. However, this does not change any data that may already have been extracted using the software. Other national police agencies contacted by Politico did not respond. “In December 2022 and October 2023, Reiber falsely certified to the U.S. government that Oxygen Forensics had no immediate or highest-level owner. According to the affidavit, in November 2023, a reporter asked Reiber about Oxygen Forensics’ ownership and its connection to the Russian company.” continues DoJ. “Reiber then wrote to Davydov and two other Russian owners that public reporting on the connection “could destroy this entire opportunity,” referring to a pending contract with the National Computer Forensics Institute, and that the “current existence of this company hangs in the balance.”” Natalia Krapiva at Access Now put the stakes about as plainly as they can be put: civil society groups had flagged Oxygen’s Russian links for years, and this case just confirmed what they’d been saying. “If in fact Russian-made software designed for the FSB and Investigative Committee was used for handling EU Commission criminal evidence database, it raises a serious possibility of sensitive information being compromised and accessed by Russian authorities,” Krapiva told Politico. “We call on the EU and every government using these tools to suspend them and fully investigate how a Russian-owned company spent a decade inside Western law enforcement.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Oxygen Forensics)
We introduce OperTraitor, a tool to audit privileges of Kubernetes operators, identify excessive RBAC risks, and secure non-human identities. The post OperTraitors: How Kubernetes Operators Betray Your Security Posture appeared first on Unit 42.
Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks. The vulnerability, tracked as CVE-2026-86950, refers to an out-of-bounds write impacting the CoreGraphics component that could lead to arbitrary code execution when processing a maliciously crafted file. The iPhone maker said the
The threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using compromised service principals. Microsoft, which is tracking the activity under the name Storm-3168, has called it an evolution of the threat actor's tradecraft. The attack took place in early June 2026 over a period of about 18 hours. "The destructive operations
Anthropic now allows you to run Claude Code via cloud sessions without signing up for the research preview, and it's offering up to $250 in free promotional credits. Cloud sessions run Claude Code on Anthropic's infrastructure instead of your own computer, so you can start a task, leave it running remotely, and return later to review the work. "Cloud sessions run on Anthropic-hosted infrastructure, so the work keeps going even without your computer running," Anthropic explained. In our tests, we observed that you can start a cloud session from claude.ai/code, the Code section of the Claude mobile app, the desktop app, or the CLI using claude --cloud. Claude Code's cloud sessions have been available to some users via research preview, but now they're officially available to eligible subscribers, and Anthropic is offering free usage credits to encourage existing subscribers to try them.
Security leaders keep debating whether AI will produce an entirely new class of cyberattack. The nearer change is quieter and already visible: AI has made a failed attack cheap to retry. The routine version looks like this. An attacker lands on a low-privilege cloud account, and the first try at privilege escalation goes nowhere. That dead end used to cost hours of documentation reading,
Confirm this action.
Leaving now will discard your changes.