--- title: "1,000 exposed GitLab servers later, the patch clock belongs to a partner" description: "Shadowserver counts 1,000-plus servers exposed to an actively exploited CVSS 10.0 GitLab bug and 11,300-plus to a second one, after CISA's federal deadline passed. GitLab's answer: a partner, RapidFort, now sells the hardened patch clock." publisher: "The Inference" section: "Security" published: 2026-11-03T15:20:24.441Z modified: 2026-11-03T15:20:24.441Z canonical: https://theinference.org/article/1-000-exposed-gitlab-servers-later-the-patch-clock-belongs-to-a-partner language: en keywords: "GitLab, Cybersecurity, Vulnerabilities, CISA, DevOps" --- # 1,000 exposed GitLab servers later, the patch clock belongs to a partner > Shadowserver counts 1,000-plus servers exposed to an actively exploited CVSS 10.0 GitLab bug and 11,300-plus to a second one, after CISA's federal deadline passed. GitLab's answer: a partner, RapidFort, now sells the hardened patch clock. [GitLab](https://theinference.org/markets/companies/gitlab) patched a maximum-severity, actively exploited code-execution bug on October 12 and told everyone to upgrade immediately [1][2]. Three weeks later, Shadowserver, the threat watchdog that counts exposed hosts, still tracks more than 1,000 internet-facing GitLab servers running unpatched for that flaw, CVE-2026-97229, which [CISA added to its Known Exploited Vulnerabilities catalog](https://www.thefivenines.com/security/cisa-confirms-exploitation-of-critical-gitlab-rce-flaw) on October 29 with a November 1 federal patch deadline [1][2]. [Alpine Linux was among the targets](https://theinference.org/article/gitlab-stock-hit-its-52-week-high-the-day-alpine-s-gitlab-was-rebuilt-from-scratch). Attackers sent malicious CI/CD configurations that crashed eight workers, four attempts showing signs of partial success, and the project [rebuilt its GitLab from scratch](https://www.scworld.com/brief/alpine-linux-rebuilds-gitlab-instance-following-exploit-attempts) because the logs were gone [5]. ## 30% of the visible estate runs a second unpatched 10.0 The bigger number is quieter. The same Shadowserver census counts over 11,300 instances vulnerable to CVE-2026-110264, a separate CVSS 10.0 bug in the same CI/CD Regular Expression Compiler, out of roughly 39,000 GitLab instances it sees daily, nearly 30% of the visible estate [1][2]. [Patches for both shipped October 21 in seven versions](https://www.bleepingcomputer.com/news/security/over-1-000-gitlab-servers-vulnerable-to-code-execution-attacks/) [1]. Neither number is moving the way a security team would want, and GitLab's own scale, 70 million registered users and more than half of the Fortune 100, makes the unpatched slice a map of exactly the accounts this news touches: banks, governments, air-gapped networks [1]. *Chart: **Nearly 30% of visible GitLab instances run an unpatched second 10.0 flaw** Bar chart of GitLab instances: 39,000 visible daily, 11,300 vulnerable to CVE-2026-110264, 1,000 vulnerable to exploited CVE-2026-97229* *Instances tracked by Shadowserver as of November 1-2, 2026; counts of internet-visible GitLab servers. Sources: BleepingComputer, Five Nines. [1][2]* ## The patch clock now belongs to a partner On November 3, GitLab's answer arrived through RapidFort, a Sunnyvale supply-chain security firm: [hardened container images for regulated self-managed deployments](https://ca.finance.yahoo.com/news/rapidfort-deliver-hardened-container-images-090000499.html), near-zero CVE posture, FIPS 140-2/140-3 alignment, STIG-hardened configs, and a published SLA of seven calendar days for critical and high CVEs [4]. Read that SLA carefully. A partner is now selling the patching promise GitLab's own release process has failed to land on three exploited flaws this year, and selling it to the regulated buyers self-managed exists to serve [3]. ## What to watch Not a short thesis: GitLab.com was never exposed, and every KEV-listed flaw on-prem is a sales pitch for the hosted tier where the margin sits. The tell is the next 10-Q: self-managed license revenue, and whether regulated buyers deferred Ultimate renewals [3][4]. If hardened images, not GitLab releases, become the regulated standard, the moat holds, but the packaging question is now someone else's to answer [3][4]. ## Takeaway Three weeks after GitLab patched an actively exploited CVSS 10.0 bug, Shadowserver still counts 1,000-plus exposed servers and 11,300-plus open to a second 10.0 flaw; GitLab's answer is a partner, RapidFort, selling a seven-day hardened-image SLA, which shifts the regulated patch promise (and the moat question) outside GitLab's own release process. ## Sources 1. [BleepingComputer, Over 1,000 GitLab servers vulnerable to ongoing RCE attacks, 2 November 2026](https://www.bleepingcomputer.com/news/security/over-1-000-gitlab-servers-vulnerable-to-code-execution-attacks/) 2. [Five Nines, CISA confirms exploitation of critical GitLab RCE flaw, 30 October 2026](https://www.thefivenines.com/security/cisa-confirms-exploitation-of-critical-gitlab-rce-flaw) 3. [SC Media, Over 1,000 GitLab servers exposed to exploited critical RCE flaw, 2 November 2026](https://www.scworld.com/news/over-1000-gitlab-servers-exposed-to-exploited-critical-rce-flaw) 4. [Business Wire via Yahoo Finance, RapidFort to Deliver Hardened Container Images for GitLab Regulated Self-Managed Deployments, 3 November 2026](https://ca.finance.yahoo.com/news/rapidfort-deliver-hardened-container-images-090000499.html) 5. [SC Media, Alpine Linux rebuilds GitLab instance following exploit attempts, late October 2026](https://www.scworld.com/brief/alpine-linux-rebuilds-gitlab-instance-following-exploit-attempts) --- 1,000 exposed GitLab servers later, the patch clock belongs to a partner — The Inference. Canonical: https://theinference.org/article/1-000-exposed-gitlab-servers-later-the-patch-clock-belongs-to-a-partner