Attackers are currently exploiting security flaws in Cisco's firewalls and in GitLab. There is little detail about the nature and scale of the attacks, but Cisco recommends installing the fixed versions right away. The US agency CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog.
Cisco ASA and FTD: reboot by VPN request
On Wednesday evening, Cisco published an advisory on a denial-of-service flaw in the SSL VPN of its Cisco ASA and Cisco FTD firewalls (CVE-2026-76418, CVSS 8.6, rated high). The cause is a logic error that shows up when "secondary authentication" is configured in the tunnel group. Attackers can then send crafted requests while connecting to the SSL VPN, and the appliance reboots.
There is no official workaround. Certain settings can help, but they come with restrictions for users. Updating is the better option. According to Cisco, these versions and later are no longer affected:
- Cisco Secure Firewall ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1
- Cisco Secure FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1
GitLab: code execution through crafted regex
The GitLab flaw became known in mid-October and carries the maximum score (CVE-2026-97229, CVSS 10.0, critical). Without logging in, attackers can use carefully crafted regular expressions in a CI/CD configuration to run malicious code on GitLab servers. According to the patch release of October 12, GitLab 19.2.8, 19.3.5, 19.4.2 and later fix the issue.
CISA only confirms that attacks have been observed. The Alpine Linux team reveals more in a notice about a security incident. On October 20 and 21, a week after the updates came out, the project's GitLab instance was attacked. The team found no evidence of a successful break-in. It still considers the instance compromised and rebuilt it from scratch.
Why the update alone was not enough
At the time of the attack, Alpine was still running the vulnerable version 19.3.4. On October 13, the team had accidentally deployed that version instead of the fixed 19.3.5. Even the upgrade to 19.3.6 on October 22 did not close the hole. The reason: the fix is not in GitLab's own code but in a patch for Ruby, which GitLab only includes in its official packages. The Alpine image, however, used stock Ruby without that patch.
So if you run GitLab with a self-managed Ruby, updating GitLab is not enough. Ruby needs to be at least 3.3.13, 3.4.12 or 4.0.9. Alpine finished the rebuild on Wednesday, is still testing before reopening, and has reset all passwords. If you use the container image "alpinelinux/gitlab", download version 19.3.6 again. Only the image from October 27 ships Ruby 3.3.13 and closes the flaw.