
GitLab CVE-2026-97229: Exploited Regex RCE, Patch Now
CISA lists GitLab CVE-2026-97229, a CVSS 10.0 regex flaw in CI/CD, as exploited. Fixed GitLab versions, the Ruby 3.4.12 fix and how to check your server.
Thoughts on eCommerce development, lessons from projects, and the occasional technical deep-dive.

PHP2Shell (CVE-2026-109618, CVE-2026-109619) allows unauthenticated RCE. Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Shopify, WooCommerce and Magento: who must act.

Node.js Brotli decoder RCE (CVE-2026-111497) and nine more CVEs fixed in 26.12.1, 24.22.1 and 22.23.4. What Vercel, Netlify and Shopify app teams must do.

Railway security breach: environment variables may have been exposed. Rotate every secret, Stripe keys first, deploy the changes and check for misuse.