--- title: "GitLab's second 10.0-severity patch in nine days hits self-managed servers with downtime, not GitLab.com" description: "GitLab fixed its hosted services centrally on October 21; its self-managed customers face a second upgrade in nine days for a flaw reaching back to 2014, with downtime attached on some servers. The stock trades near its high on AI-driven demand for the governance these flaws keep testing." publisher: "The Inference" section: "Security" published: 2026-10-22T15:16:48.529Z modified: 2026-10-22T15:16:48.529Z canonical: https://theinference.org/article/gitlab-s-second-10-0-severity-patch-in-nine-days-hits-self-managed-servers-with-downtime-not-gitlab-com language: en keywords: "Security, GitLab, Vulnerabilities, Open Source, Developer Tools" --- # GitLab's second 10.0-severity patch in nine days hits self-managed servers with downtime, not GitLab.com > GitLab fixed its hosted services centrally on October 21; its self-managed customers face a second upgrade in nine days for a flaw reaching back to 2014, with downtime attached on some servers. The stock trades near its high on AI-driven demand for the governance these flaws keep testing. [GitLab](https://theinference.org/markets/companies/gitlab) [shipped its second maximum-severity patch](https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html) in nine days on October 21, and the bill lands on the customers it most wants to keep: the ones running the platform on their own servers [1]. GitLab.com, its public hosted service, and GitLab Dedicated, its single-tenant hosted offering on [AWS](https://theinference.org/markets/companies/amazon), were fixed centrally [1][2]. Only self-managed customers carry the cost, and that asymmetry is the money question. The flaw, CVE-2026-110264, scores the maximum 10.0 on the CVSS severity scale and lets an attacker with no account run code on a self-managed server [1]. It reaches every release back to version 7.0, from 2014 [1]. Anyone who upgraded on October 12, after the previous maximum-score flaw, is in range again [1]. ## The flaw sits in an engine GitLab has shipped since 2014 Onigmo is the regular-expression compiler Ruby uses, and GitLab bundles it and patches it inside its own builds [1]. An integer overflow in that engine, set off by a specially crafted regex, becomes unauthenticated code execution, and the weakness has been present in every release since 7.0 [1]. GitLab fixed seven versions at once, including four branches its support policy normally leaves unpatched [1]. Two of those releases carry database migrations, which means downtime on a single-node server [1]. This is the fourth code-execution flaw in that engine from the researcher joaxcar in a month, and GitLab has named no attack preconditions and offers no workaround [1]. ## The stock prices the governance story, not the patch bill GTLB, GitLab's Nasdaq ticker, [closed at $55.00 on October 20, near the top of its 52-week range](https://www.gurufocus.com/news/9132866/gitlab-inc-gtlb-shares-surge-32-what-gf-score-of-84-tells-investors) [3]. The stock is up 46.5% this year [3]. The quarter reported in September [grew revenue 21% to $286.3 million](https://pulse2.com/gitlab-q2-fiscal-2027-revenue-rises-21-to-286-3-million-as-net-arr-growth-exceeds-40/), with dollar-based net retention at 117% and accelerating sequentially [4]. Chief executive Bill Staples tied the demand to AI writing more of the world's code: "the context, security, governance and control GitLab provides become increasingly valuable" [4]. Insiders net sold $166.6 million of stock over twelve months against $0.5 million bought [3]. The cofounder and director [Sytse Sijbrandij](https://theinference.org/markets/people/sytse-sijbrandij)'s [trust sold $6.2 million on October 19](https://www.sec.gov/Archives/edgar/data/1653482/000165348226000176/0001653482-26-000176-index.htm), between the two patches, under a trading plan adopted on June 25, before any of the four flaw disclosures; this page charted the same selling [on October 11](https://theinference.org/article/gitlab-sold-the-ai-factory-story-while-insiders-sold-103-8-million-of-the-stock) [5]. *Chart: **Revenue rose ten straight quarters while security emergencies piled up** Line chart of GitLab quarterly revenue from Q4 2023 to Q2 2026, rising from about $164 million to $286 million.* *Quarterly revenue in US$ millions from GitLab's SEC filings; labels are calendar quarters and GitLab's fiscal year ends January 31, so the last point is the quarter reported in September 2026. [7]* ## Churn and Dedicated migration are the numbers to watch No exploitation has been observed, and the flaw was not in the catalog of the U.S. Cybersecurity and Infrastructure Security Agency as of October 22 [1]. The agency has [flagged five GitLab flaws as exploited in the wild](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/) since November 2021, including a September flaw that exposed credentials and secrets and was added within a day of disclosure [6]. More than half the Fortune 100 runs GitLab, and Shadowserver, an internet threat watchdog, counts over 2,700 exposed Community Edition instances [6]. Four engine findings in a month from one researcher mean the close reading of that engine has begun, and every emergency cycle lands on customers' engineers rather than GitLab's. Buyers comparing GitLab with [Microsoft](https://theinference.org/markets/companies/microsoft)'s GitHub now have a second emergency in nine days to weigh, and [Rapid7](https://theinference.org/markets/companies/rapid7) turned the first into a live product demo, [as this page reported on October 16](https://theinference.org/article/rapid7-turns-gitlab-s-10-0-flaw-into-a-live-product-demo-three-weeks-before-earnings) [6]. On Dedicated, GitLab itself [applies security patches during a weekly maintenance window](https://docs.gitlab.com/administration/dedicated/) the customer chooses [2]. Whether self-managed customers keep absorbing these cycles or move to that hosting is what the next earnings report can show, and the two lines worth listening for in it are self-managed churn and Dedicated-migration language. ## Takeaway GitLab fixed its hosted services centrally on October 21, but self-managed customers must patch again in nine days, with downtime on single-node servers; the revenue and the stock still price AI-driven demand for governance, so the numbers to watch in the next quarter are self-managed churn and Dedicated migration. ## Sources 1. [The Hacker News, "Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases", 21 October 2026](https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html) 2. [GitLab Docs, "Administer GitLab Dedicated", retrieved 22 October 2026](https://docs.gitlab.com/administration/dedicated/) 3. [GuruFocus, "GitLab Inc (GTLB) Shares Surge 3.2%: What GF Score of 84 Tells Investors", 20 October 2026](https://www.gurufocus.com/news/9132866/gitlab-inc-gtlb-shares-surge-32-what-gf-score-of-84-tells-investors) 4. [Pulse 2.0, "GitLab: Q2 Fiscal 2027 Revenue Rises 21% To $286.3 Million As Net ARR Growth Exceeds 40%", 3 September 2026](https://pulse2.com/gitlab-q2-fiscal-2027-revenue-rises-21-to-286-3-million-as-net-arr-growth-exceeds-40/) 5. [SEC Form 4, GitLab Inc., Sytse Sijbrandij, filed 21 October 2026 (sale of 19 October 2026)](https://www.sec.gov/Archives/edgar/data/1653482/000165348226000176/0001653482-26-000176-index.htm) 6. [BleepingComputer, "GitLab warns of new max severity code execution vulnerability", 22 October 2026](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/) 7. [GitLab, quarterly revenue from its SEC filings, retrieved 22 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001653482) --- GitLab's second 10.0-severity patch in nine days hits self-managed servers with downtime, not GitLab.com — The Inference. Canonical: https://theinference.org/article/gitlab-s-second-10-0-severity-patch-in-nine-days-hits-self-managed-servers-with-downtime-not-gitlab-com