Daily briefing · September 11, 2026
GitLab Critical Zero-Day Under Active Exploitation Leads a Heavy Patch Day with 36 Critical CVEs
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — attention1 seen before CISA
September 11, 2026 demands immediate attention from security teams: a CVSS 10.0 vulnerability in GitLab CE/EE was detected by VulnCheck as actively exploited before any CISA confirmation, allowing unauthenticated file read from GitLab servers. The day recorded 680 new CVEs, 36 of them critical, with a cluster of CVSS 10.0 flaws spanning developer tools, AI coding assistants, and enterprise DevOps platforms. The overall verdict is CAUTION — not crisis, but the GitLab exploitation signal alone is enough to push patch cycles forward.
Today’s brief
- GitLab CVE-2026-85706 (CVSS 10.0) is already being exploited in the wild per VulnCheck — unauthenticated arbitrary file read, patch immediately
- Four CVSS 10.0 RCE flaws in Mistral Vibe expose AI coding assistant users to command execution bypass via shell parsing tricks and environment variable abuse
- WordPress plugins (teddy-bear-customize-addon, MIPL WooCommerce) allow unauthenticated PHP file uploads — easy targets for mass exploitation
- Brazil is under sustained ransomware pressure: three new victims across manufacturing, healthcare, and technology sectors in recent days
Critical highlights
1
CVSS 10.0 and already observed by VulnCheck in active exploitation before CISA confirmation — an unauthenticated attacker can read arbitrary files from the GitLab server via improper path confinement in the repository commits API, potentially exposing source code, credentials, and secrets. All GitLab CE/EE installations prior to 19.1.8, 19.2.6, or 19.3.2 are affected; treat this as an emergency patch.
2
This WordPress plugin flaw allows unauthenticated attackers to upload arbitrary PHP files because file validation relies entirely on the client-supplied content type, with the original filename preserved — leading directly to remote code execution on any vulnerable site. The proof-of-concept availability combined with the plugin's trivial exploitation path makes mass-scanning campaigns highly likely.
3
Apache OpenNLP's built-in regex name-finder patterns contain ambiguous nested quantifiers, exposing applications that process untrusted text to catastrophic ReDoS (Regular Expression Denial of Service) — effectively a resource exhaustion vector that can take down services processing user-supplied input. Any pipeline built on RegexNameFinderFactory with external data sources should be treated as at risk.
4
Mistral Vibe allows an attacker to access files outside the active workspace by abusing commands classified as unconditionally allowed, with missing path validation as the root cause — a classic path traversal enabling data exfiltration without user approval. The severity is compounded by Vibe's integration into developer workflows where sensitive project files are routinely present.
5
An attacker can achieve arbitrary code execution in Mistral Vibe by prepending environment variable assignments to allowlisted commands, since those assignments are excluded from permission inspection — effectively a sandbox escape requiring no privilege escalation. This and the sibling CVEs collectively destroy the trust model of Vibe's permission system.
6
Shell constructs that Mistral Vibe's parser cannot interpret are silently omitted from the permission check, allowing embedded commands to execute on the user's system without approval. This is a parser confusion attack — the kind that is notoriously difficult to fully remediate with patchwork fixes and may require architectural changes.
7
ANSI-C quoted arguments in Mistral Vibe bypass command permission checks entirely, enabling a crafted allowlisted command to execute arbitrary code on the user's machine without prompting. Combined with CVE-2026-87986, 87987, and 87988, the Vibe permission model should be considered untrusted until a comprehensive fix is verified.
8
An unauthenticated actor may gain elevated access to protected Chef Automate functionality under specific conditions in the API gateway and identity validation path — a privilege escalation without credentials in an infrastructure automation platform that typically holds configuration secrets and deployment credentials for entire environments.
9
A CVSS 9.9 flaw in GitLab EE allows an authenticated user with Duo Chat access to extract Advanced Search instance configurations and sensitive credentials via a crafted GraphQL subscription argument, exploiting a server-side object injection / deserialization bypass. A proof of concept exists, and the impact is particularly severe in environments where GitLab indexes sensitive repositories.
10
CVE-2026-8778CVSS 9.8affects MIPL Grouped Checkout Fields for WooCommerce. Customize & Organize Checkout Fields. The MIPL Grouped Checkout Fields for WooCommerce plugin allows unauthenticated file uploads due to missing file type validation in the upload handler, enabling remote code execution on any affected e-commerce site through a straightforward web shell deployment. WooCommerce store operators running version 1.2.1 or earlier should prioritize this patch given the ease of exploitation.
Ransomware today
Three Brazilian organizations were recently claimed as ransomware victims: Tuboaços da Amazônia Ltda. (manufacturing) by nightspire, amorsaude.com.br (healthcare) by lockbit5, and Logar Network Solutions (technology) by Vexy Ransomware. Over the past 30 days, thegentlemen has emerged as the most active group against Brazilian targets with at least nine claimed victims, followed by krybit, direwolf, dragonforce, and emperador. The breadth of sectors hit — manufacturing, healthcare, technology — signals broad opportunistic targeting rather than vertical-specific campaigns.
Tuboaços da Amazônia Ltda. BRnightspire · Manufacturing
amorsaude.com.br BRlockbit5 · Healthcare
Logar Network Solutions BRVexy Ransomware · Technology
thegentlemen 9krybit 3direwolf 2dragonforce 2emperador 2Vexy Ransomware 2
Active groups & APTs
Several threat actor groups are being monitored for updated activity, including dragonforce, fulcrumsec, funksec, linkc, spacebears, and the Iran-linked blackshadow. While no new confirmed victims are currently attributed to these groups in this cycle, their continued tracking reflects ongoing intelligence interest and the potential for sudden operational surges — particularly dragonforce, which has been active against Brazilian targets in the 30-day window.
Brazil focus
Brazil is facing a notably high tempo of ransomware activity across critical sectors. Recent victims include Zanini and Biotipo Jeans (manufacturing and retail, both claimed by thegentlemen), Lider Aviacao (transportation, thegentlemen), Mutant (thegentlemen), and Alurwalls (manufacturing, Dark Project), in addition to the three victims reported in the most recent wave. The concentration of incidents attributed to thegentlemen specifically against Brazilian organizations warrants elevated defensive posture for companies in the country.
Tuboaços da Amazônia Ltda.nightspire · Manufacturing
Logar Network SolutionsVexy Ransomware · Technology
amorsaude.com.brlockbit5 · Healthcare
Zaninithegentlemen · Manufacturing
Biotipo Jeansthegentlemen · Retail & E-Commerce
Mutantthegentlemen · Other
AlurwallsDark Project · Manufacturing
Lider Aviacaothegentlemen · Transportation
Today’s recommendation: GitLab administrators should treat CVE-2026-85706 as an emergency and upgrade to 19.1.8, 19.2.6, or 19.3.2 immediately; teams using Mistral Vibe should disable or restrict its use pending vendor confirmation that all four command-bypass CVEs are fully resolved. All WordPress site operators should audit installed plugins against today's advisories and enforce server-side file type validation as a compensating control.
With multiple CVSS 10.0 vulnerabilities disclosed across developer tools and CMS platforms today, the critical question for every security team is whether any of these affected products exist — potentially unpatched or shadow-deployed — within their own environment, making continuous attack surface validation essential.Every CVE above is a possible door — find out which ones are open in your environment with a free attack-surface check.Meet the Autonomous AI Pentest Agent →Previous briefings
September 20, 2026 — Dozens of Critical PoC Flaws Surface in Routers and Research Tools, But No Active Exploitation DetectedSeptember 19, 2026 — Calm Vulnerability Day Masks Serious Flaws in Routers, WordPress, and SuricataSeptember 18, 2026 — WordPress, IBM, and vm2 Flaws Anchor a High-Alert Day With 5 CVEs Already Under Active ExploitationSeptember 17, 2026 — Six CVSS 10.0 Azure Flaws Lead a Heavy Patch Day as Acronis Backup Plugin Faces Active ExploitationSeptember 16, 2026 — Cisco Infrastructure Flooded With CVSS 10 Flaws as VulnCheck Spots Active Exploitation Before CISASeptember 15, 2026 — Oracle Patch Tuesday Surge and Yonyou Active Exploitation Drive ATTENTION-Level AlertSeptember 14, 2026 — Cisco Secure Email Under Active Exploitation as 58 Critical CVEs SurfaceSeptember 13, 2026 — WordPress Plugin Flaw Leads Quiet Day With 8 Critical CVEs and No Active ExploitationSeptember 12, 2026 — WordPress Plugin Blitz: Nine Critical RCE and Takeover Flaws Disclosed on a Quiet Exploit DaySeptember 11, 2026 — GitLab Critical Zero-Day Under Active Exploitation Leads a Heavy Patch Day with 36 Critical CVEsSeptember 10, 2026 — Ten Critical CVEs Published on a Calm Threat Day as Brazil Faces Ransomware SurgeSeptember 9, 2026 — Three CVEs Already Exploited Before CISA Confirmation, Dual Check Point RCE and cPanel SQLi-to-Root Round Out a High-Alert DaySeptember 8, 2026 — Windows Under Active Exploit, ScreenConnect Zero-Day Detected Before CISA: September 8 Security BulletinSeptember 7, 2026 — 22 Critical CVEs Published on a Quiet Day, With Heavy Ransomware Pressure on Brazilview full archive →