Morning Threat Brief: GitLab 10.0 hits KEV, Cisco joins it, and a $6.3 billion theft

Good morning. Two KEV additions share a Sunday deadline, a crypto exchange says a single compromised laptop led to the largest theft on record, and a booking system breach touched about 92,000 airline passengers. Patch the code host and the firewall first, then look at the human route in.

1. GitLab CVSS 10.0 flaw now in CISA KEV: update GitLab and check Ruby, not just GitLab (CVE-2026-97229). CISA added the flaw to KEV on October 29, with a federal due date of November 1, and flags forensic triage. The integer overflow sits in Onigmo, the regular expression engine inside Ruby, which GitLab uses to compile regular expressions in CI/CD configuration files. Under certain conditions, a specially crafted regular expression can let an attacker run code on a self-managed GitLab server, and Rapid7 reproduced code execution on an unpatched GitLab 19.4.1 image. Rapid7 notes the attacker first needs a way to get a malicious CI file into a project, which is easy where anyone can register and create public projects. The real world warning comes from Alpine Linux: a newly registered account sent crafted CI configurations to its GitLab server on October 20 and 21, crashed worker processes eight times, and got partway through the exploit in four of those crashes. Alpine found no proof the attacker got in, but could not rule it out, so it rebuilt the server, reset every password, and rotated GitLab secrets. Upgrade self-managed GitLab to 19.2.8, 19.3.5, 19.4.2, or later, and verify Ruby too: source installs and custom images need Ruby 3.3.13, 3.4.12, or 4.0.9, because upgrading GitLab alone left Alpine exposed. If you cannot patch yet, restrict open registration and untrusted creation of public projects, and hunt worker crashes, 502 errors around CI lint requests, and new accounts since October 12. If anything looks off, treat the host as compromised and rebuild it.

2. Cisco firewall flaw joins KEV: the same Sunday deadline (CVE-2026-76418). CISA added the Cisco flaw to KEV on October 29, with a federal due date of November 1. This is the same flaw covered yesterday from Cisco's advisory, now with the federal deadline attached. An unauthenticated remote attacker can send a crafted request to the Remote Access SSL VPN service, when secondary authentication is configured on a tunnel group, and force ASA or FTD to reload. That is an outage, not a data theft story so far, and Cisco has not named the attackers or published indicators for this flaw. Patch to a fixed release now, including ASA 9.24.10.1 or the matching branch fix and FTD 10.1.1 or the matching branch fix. If you cannot patch yet, use Cisco's interim step and disable secondary authentication on the affected tunnel groups, including the default group, until you can.

3. Binance links a $6.3 billion theft to a compromised DevOps laptop. Binance said a compromised DevOps engineer's laptop gave attackers access to a service container, letting them submit unauthorized withdrawal transactions. On October 29, about $6.36 billion moved out of Binance wallets across ten blockchains in about 20 minutes, which BleepingComputer reports as the largest crypto theft on record, about four times the February 2025 Bybit theft. Binance says it has found no evidence of a leaked wallet private key and that customer funds are safe. Attribution is separate from Binance's statement: blockchain firm TRM Labs attributed the theft to TraderTraitor, a North Korean unit also tracked as Lazarus Group and APT38, and Chainalysis agreed with high confidence. The lesson is not a customer password reset. It is privileged workstation control: a DevOps laptop with a path to withdrawal services needs hardware backed authentication, tight session controls, and monitoring that treats a new withdrawal pattern as an incident, not routine traffic.

4. Japan Airlines breach via the Amadeus booking system touches about 92,000 passengers. Japan Airlines said a breach at Amadeus's Passenger Service System exposed data for about 92,000 customers, after Amadeus notified the airline on October 23 of unauthorized access between August 10, 2023 and September 23, 2026. The exposed data included reservation codes, names, flight dates, routes, and travel classes. Japan Airlines says credit card numbers and passwords were not compromised, it has no evidence of customer information being misused, and flight operations are unaffected. All Nippon Airways also announced a tied breach, and Asiana Airlines and Korean Air had previously confirmed impact from the same Amadeus flaw. If you flew with these carriers, treat any message quoting your booking reference as suspect until you verify it through the airline directly, and do not click a link in a message about a changed booking. For companies, this is a third party dwell time story: three years of access through a vendor system is a vendor access audit, not a single incident response.

Warning: two federal KEV deadlines land this weekend. The Linux kernel flaw from yesterday is due Saturday, October 31, and both of today's KEV additions are due Sunday, November 1. Patch before the weekend, not on Monday morning.

Full writeups: kevinthecyberguy.com/vuln-watch
Indicators to hunt: kevinthecyberguy.com/ioc-library

New CISA KEV additions today: CVE-2026-97229, GitLab, and CVE-2026-76418, Cisco, federal due dates November 1, 2026.

← kevintswaney.com