Description

GitLab fixes a CVSS 10.0 unauthenticated RCE, Railway tells all users to rotate keys, and Node2Shell hits Node.js.

Sources:

• Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
• Developer platform Railway urges 'all users' to revoke secret keys after cyberattack | TechCrunch
• Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497) and the fix
• Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web · Forever Security
• Internet2's certificate authority (eMudhra) is being distrusted

📰 Read the full edition on the site

🤖 Episode produced with artificial intelligence. Synthetic voice.