Vendors push large patch batches: GitLab RCE fixes, Atlassian and HPE updates

2026-10-24 · Cybersecurity

Ruby released versions 4.0.9, 3.4.12 and 3.3.13 to fix three bugs in Onigmo, its built-in regular expression engine, which lie behind four critical remote code execution flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it. In the same patch cycle, Atlassian's October bulletin lists 176 vulnerability entries covering 75 flaws in its Data Center and Server products, including 14 critical issues, all in third-party components. Hewlett Packard Enterprise separately shipped updates for 72 vulnerabilities in ArubaOS, including eight maximum-severity authentication bypass and code execution issues. The volume underscores how dependency and third-party component bugs drive enterprise patching workloads.

Why it matters：Critical RCE flaws traced to shared language runtimes and third-party components show how upstream bugs propagate into enterprise software patching.

Key points

• Four critical GitLab RCE flaws trace back to Ruby's Onigmo engine
• Atlassian's bulletin covers 75 flaws, 14 critical, all in third-party components
• HPE fixed 72 ArubaOS vulnerabilities, eight of maximum severity

Sources (original reporting)

• The Hacker News
• SecurityWeek
• BleepingComputer

More stories from this day

• PHP2Shell exploitation attempts grow; new unpatched PHP flaw disclosed
• Campaign breaches Fortinet and Palo Alto edge devices, exposing 70,000 credentials
• Quest Diagnostics reports patient data breach in lab ordering system
• Researchers detail AI-driven intrusion tools used by ransomware and state actors
• DeepSeek Raises $15.9 Billion in Second Funding Round
• American Express cuts 5% of workforce in AI restructuring