ITsecurity Daily
Daily Briefing
GitLab urges an immediate patch for a max-severity RCE flaw as Google fixes six critical Chrome vulnerabilities — patch both today
Good morning. BleepingComputer reported that GitLab warned users to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. Treat this as the day's top priority and apply the patch GitLab's advisory directs.
Google released a Chrome stable channel update for desktop. Google's advisory lists six vulnerabilities each carrying a CVSS base score of 9.6 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): CVE-2026-106419, CVE-2026-106417, CVE-2026-106414, CVE-2026-106401, CVE-2026-106382 and CVE-2026-106375. The advisory lists the fix in Chrome 155.0.8059.39; update to that release and restart the browser to apply it (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html). None are listed on CISA's KEV catalog.
SecurityWeek reported that a vulnerability in the Bricksforge WordPress plugin is being exploited in the wild and can allow threat actors to take control of targeted WordPress websites. If you run Bricksforge, check the vendor's advisory for a fix and review the site for signs of compromise.
Zoom out: The Hacker News reported that attackers this week began testing a newly disclosed flaw within hours of its publication.
Vulnerability in focus
CVE-2026-106419 — Google. CVSS 9.6
Affected: chrome.
What to do: Follow the vendor advisory for the fixed release and any interim mitigation.
Elsewhere
- Help Net Security: Be a good AI ancestor: Cybersecurity already gave us the playbook Read it
- Help Net Security: Frontier AI cleared every OT attack goal Booz Allen set in its lab Read it
- Help Net Security: Most high-severity cloud security findings are downgraded once an AI agent checks the environment Read it
- Help Net Security: Cybersecurity jobs available right now: October 13, 2026 Read it
- The Hacker News: ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More Read it
- BleepingComputer: Ledger confirms hardware wallet spy implant behind crypto thefts Read it
- Help Net Security: Cyberattacks hit European grocers: French supermarket freezers hijacked, Dutch and Belgian stores disrupted Read it
- BleepingComputer: Cyberattack shuts down refrigerators at French supermarkets Read it
- Schneier on Security: FBI Arrests Suspect in FBI-Hacking Case Read it
- SecurityWeek: IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion Read it
- BleepingComputer: Retail giant Ahold Delhaize takes systems offline after cyberattack Read it
- SecurityWeek: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild Read it
Sources
- Anthropic takes risky AI tests offline after models breach govt sites BleepingComputer
- Cyberattacks hit European grocers: French supermarket freezers hijacked, Dutch and Belgian stores disrupted Help Net Security
- ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More The Hacker News
- FBI Arrests Suspect in FBI-Hacking Case Schneier on Security
- IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion SecurityWeek
- Imagine there's no Shiny Hunters – AI could make human hacking crews obsolete The Register
- Cyberattack disrupts refrigeration at hundreds of French supermarkets The Record
- Ledger confirms hardware wallet spy implant behind crypto thefts BleepingComputer
- Cyberattack shuts down refrigerators at French supermarkets BleepingComputer
- Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption BleepingComputer
- Retail giant Ahold Delhaize takes systems offline after cyberattack BleepingComputer
- Bricksforge WordPress Plugin Vulnerability Exploited in the Wild SecurityWeek
- GitLab warns of max severity code execution vulnerability BleepingComputer
- Canonical Websites Disrupted in Second DDoS Attack This Year SecurityWeek
Share this issue
Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky
Every briefing is on the site, with the advisory record behind it. All briefings