self-hosting
3 articles with this tag
Nextcloud built-in Collabora CODE server CVE-2026-110447 exploited: who is affected and what to do
On October 14, 2026, the Collabora Online developers disclosed CVE-2026-110447, an unauthenticated OS command injection vulnerability in the Nextcloud app Collabora Online - Built-in CODE Server (app ID richdocumentscode). Through the app's proxy.php, commands can run as the web server user. The condition is that the built-in CODE server is not running, which can happen after a container restart, an upgrade or a crash. Versions before 26.4.303 are affected; 26.4.303 was released on September 11. The developers say disabling the app does not prevent the problem and ask users to update or remove it. On end-of-life Nextcloud 29 and earlier, update Nextcloud or remove the app. The developers say standalone Collabora Online servers, Docker images, RPM/DEB packages and Nextcloud All-in-One are not affected. The CVSS v4.0 score is 9.2. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 23 with a due date of October 26. Users reported attacks from around September 10 in the developers' repository, and according to press reports web shells were planted. This site's conclusion: if the built-in CODE app is installed, even disabled, check its version today, update or remove it, then check for traces since September 10.
GitLab CVE-2026-110264 (CVSS 10.0) and the exploited CVE-2026-97229: how to check and update a self-managed GitLab
On October 21, 2026, GitLab released critical patch versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for Community Edition (CE) and Enterprise Edition (EE). The most severe flaw, CVE-2026-110264 (CVSS 10.0), is an integer overflow when compiling a specially crafted regular expression that, under certain conditions, could allow an unauthenticated user to execute arbitrary code on the GitLab server. Almost every version from 7.0 onward is affected. On October 29, CISA added a sister flaw, CVE-2026-97229 (CVSS 10.0, CWE-190), to its Known Exploited Vulnerabilities (KEV) catalog with a due date of November 1. It is the same kind of bug (an integer overflow in the CI/CD regular expression compiler, reachable by an unauthenticated user), GitLab fixed it earlier on October 12 in 19.4.2, 19.3.5 and 19.2.8, and it affects only 19.2.0 to 19.2.7, 19.3.0 to 19.3.4 and 19.4.0 to 19.4.1. Anyone still below 19.4.2, 19.3.5 or 19.2.8 is exposed to an exploited flaw. Upgrading to the versions recommended here (19.5.1, 19.4.3, 19.3.6, 19.2.9) also fixes CVE-2026-97229. GitLab.com is already patched; self-managed installations need to upgrade. The same October 21 release fixes two High-severity flaws (CVSS 8.2 and 7.5) and others, but those fixes ship only in the 19.3.6, 19.4.3 and 19.5.1 lines. The root cause is in Ruby's regular expression engine (Onigmo), and Ruby released 4.0.9, 3.4.12 and 3.3.13 on October 23. Applications that compile a regexp from attacker-controlled strings are affected, and Regexp.timeout does not protect against the bugs. GitLab's notices do not say CVE-2026-110264 has been exploited, and it is not in KEV as of October 30. Alpine Linux reported on its own GitLab an attempted attack through CVE-2026-97229 on October 20 and 21, and that upgrading GitLab alone (to 19.3.6) did not close the flaw because the fix also needed a patched Ruby; it rebuilt the instance and found no evidence that attacker code ran. This site's conclusion: upgrade self-managed GitLab today after checking the required upgrade stops, end up on 19.3.6 or later, and if you build GitLab yourself or run your own Ruby, check that Ruby is 3.3.13, 3.4.12 or 4.0.9 or later too. Ruby applications should move to a fixed Ruby and stop building regexps from user input.
Self-hosted Git vs GitHub: which is actually more secure?
Self-hosting Git doesn't make you 'more secure' — it relocates the risk. The accidental-public-exposure class disappears, but patching the server, backups, and pre-commit secret detection move onto you. The right call if you keep doing that work; worse than GitHub if you neglect it. This site's view: self-hosting only works bundled with its compensating controls.