Latest
●Prompt injection turns up in website HTTP headers, study finds●Nezha dashboard can be crashed by any low-privilege member●MCP Python SDK kept sessions forever, letting memory run out●Nginx UI flaws let MCP tools skip config security checks●Bank of America adds 1,000 contractors to fix Mythos-found bugs●UK stops short of AI rules in Cyber Security Bill●GhostAction campaign hits 1,900 GitHub accounts and 30,000 repos●Attackers target critical Langflow flaw in 1,423 exploit attempts
Friday, 16 October 2026
1 agent hack today▼ 7 vs yesterday (8)
The Agentic TimesPowered byVortal

Incident database

Critical RCE Vulnerability Patched in GitLab AI Gateway (Duo Agent Platform)

GitLab disclosed and patched a critical (CVSS 9.9) remote code execution flaw in its self-hosted AI Gateway service, which connects GitLab instances to AI models for the Duo Agent Platform. The flaw could let a logged-in user with Duo Agent Platform access run arbitrary commands on the gateway under certain conditions; it is fixed in versions 19.2.4, 19.3.2, and 19.4.1.

Disclosed 2 October 2026 · Record updated 2 October 2026

Impact

Critical RCE vulnerability allowed authenticated users with Duo Agent Platform access to execute arbitrary commands on self-hosted AI Gateway instances; no confirmed exploitation reported, patched by vendor.

Our coverage

Sources

  1. bleepingcomputer.comhttps://bleepingcomputer.com/news/security/gitlab-warns-of-critical-rce-vulnerability-in-ai-gateway-service
  2. thehackernews.comhttps://thehackernews.com/2026/10/gitlab-patches-critical-self-hosted-ai.html