GitLab fixes a maximum-severity unauthenticated code-execution flaw
GitLab patched CVE-2026-110264, a CVSS 10.0 integer-overflow vulnerability in its regular-expression compiler. A remote unauthenticated attacker could execute arbitrary code on affected self-managed CE and EE servers. GitLab.com and sufficiently recent Dedicated tenants are already patched.
Why it matters to you
A compromised GitLab server can expose repositories, runner credentials and deployment secrets. Upgrade self-managed installations to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, then review GitLab's published crash and render-error detections and rotate reachable secrets if exploitation is suspected.
State-linked attackers hide command traffic inside a decentralised mesh
ESET uncovered MythicRatatoskr, a Go backdoor whose command server was concealed inside the volunteer-run Yggdrasil mesh network. Russia-aligned UAC-0099 gained access to a Ukrainian grain company and handed it to Sandworm, which later used Microsoft's legitimate SDelete utility for data destruction.
Why it matters to you
A destination can look unfamiliar yet remain reachable through an encrypted overlay. Baseline installed networking software, alert on new virtual adapters and persistent IPv6 mesh traffic, restrict application egress, monitor administrative-tool deployment through Group Policy and keep recovery copies beyond domain-admin reach.
OpenAI and Poland's NASK link AI safety research to operational cyber defence
OpenAI and Poland's NASK National Research Institute agreed to collaborate on AI safety, security and technical evaluations. Earlier work through OpenAI's Daybreak programme helped CERT Polska discover six MikroTik RouterOS vulnerabilities, including a chain that could take control of devices without authentication; MikroTik released fixes.
Why it matters to you
The useful measure of an AI-security partnership is reproducible defensive output, not a memorandum. For network testing, isolate targets, define authorization boundaries, preserve model and tool-call evidence, require vendor-coordinated disclosure and retest the exact fixed firmware before closing findings.
Electrical cable production becomes another AI data-centre bottleneck
Nexans says demand for low- and medium-voltage cable is rising faster than production capacity as AI data centres expand. A new cross-linked polyethylene cable line can take about three years to build, while France's Enedis has moved from annual purchasing to six- or seven-year contracts to secure supply.
Why it matters to you
Servers and grid megawatts do not become usable racks without switchgear, distribution cable, cooling and commissioning. When evaluating a facility or provider roadmap, request delivery dates for electrical balance-of-plant equipment and distinguish reserved materials from unfunded or merely forecast capacity.
A US court tests local AI servers alongside commercial services
Louisiana's Fifth Circuit Court of Appeal installed two Dell servers with Nvidia chips, costing about $65,000 each, to develop domain-specific tools while continuing to evaluate hosted products. Initial work targets document intake and compliance, with future checks for fabricated citations and hidden prompt-injection instructions.
Why it matters to you
This is a practical hybrid-AI architecture decision. Compare hosted and local models using total cost, patching, power, capacity utilization, retention, identity controls and evaluation quality. Keep the application layer portable so sensitive workflows can move without rewriting the product.