1,000 exposed GitLab servers later, the patch clock belongs to a partner
Shadowserver counts 1,000-plus servers exposed to an actively exploited CVSS 10.0 GitLab bug and 11,300-plus to a second one, after CISA's federal deadline passed. GitLab's answer: a partner, RapidFort, now sells the hardened patch clock.
Vincent Jiang · 2 min read
GitLab+1.38% — GitLab, up 1.38 percent today patched a maximum-severity, actively exploited code-execution bug on October 12 and told everyone to upgrade immediately 12. Three weeks later, Shadowserver, the threat watchdog that counts exposed hosts, still tracks more than 1,000 internet-facing GitLab servers running unpatched for that flaw, CVE-2026-97229, which CISA added to its Known Exploited Vulnerabilities catalog on October 29 with a November 1 federal patch deadline 12.
Alpine Linux was among the targets. Attackers sent malicious CI/CD configurations that crashed eight workers, four attempts showing signs of partial success, and the project rebuilt its GitLab from scratch because the logs were gone 5.
30% of the visible estate runs a second unpatched 10.0
The bigger number is quieter. The same Shadowserver census counts over 11,300 instances vulnerable to CVE-2026-110264, a separate CVSS 10.0 bug in the same CI/CD Regular Expression Compiler, out of roughly 39,000 GitLab instances it sees daily, nearly 30% of the visible estate 12.
Patches for both shipped October 21 in seven versions 1. Neither number is moving the way a security team would want, and GitLab's own scale, 70 million registered users and more than half of the Fortune 100, makes the unpatched slice a map of exactly the accounts this news touches: banks, governments, air-gapped networks 1.
Nearly 30% of visible GitLab instances run an unpatched second 10.0 flaw
Data
| Value | |
|---|---|
| Visible instances (daily) | 39,000 |
| Vulnerable to CVE-2026-110264 | 11,300 |
| Vulnerable to exploited CVE-2026-97229 | 1,000 |
The patch clock now belongs to a partner
On November 3, GitLab's answer arrived through RapidFort, a Sunnyvale supply-chain security firm: hardened container images for regulated self-managed deployments, near-zero CVE posture, FIPS 140-2/140-3 alignment, STIG-hardened configs, and a published SLA of seven calendar days for critical and high CVEs 4.
Read that SLA carefully. A partner is now selling the patching promise GitLab's own release process has failed to land on three exploited flaws this year, and selling it to the regulated buyers self-managed exists to serve 3.
What to watch
Not a short thesis: GitLab.com was never exposed, and every KEV-listed flaw on-prem is a sales pitch for the hosted tier where the margin sits. The tell is the next 10-Q: self-managed license revenue, and whether regulated buyers deferred Ultimate renewals 34. If hardened images, not GitLab releases, become the regulated standard, the moat holds, but the packaging question is now someone else's to answer 34.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
