> Upgrading to GitLab 19.3.6 on October 22 didn’t fix the vulnerability. The fix isn’t in GitLab’s own code but in a patch to Ruby, which GitLab applies only in its official packages. Our image used standard Ruby, so it didn’t get the patch.

> The bug is in Ruby’s regular expression engine, so any program that compiles regular expressions from untrusted input is exposed, not only GitLab.

I feel like this era of constant exploits/patches is really bad for those who build from source or make their own images vs those who rely on provided images and upgrade them often. I really can't think of a decent solution for those people other than being plugged in 24/7 to the latest news which is really unfortunate and must be exhausting...

▲

Gigachad 5 hours ago | parent | next [-]

At this point if you are self hosting you should have everything behind a VPN. Only companies with their own security and development teams should be putting things on the public internet.

▲

jamesfinlayson 4 hours ago | parent [-]

Gosh I'm at a big company and I'm pretty sure all the self-hosted tools are only accessible through VPN-like tech anyway. The only truly public stuff is Jira, Confluence (which I assume it more to do with Atlassian's pricing of self-hosted) and Sharepoint.

▲

Operyl 4 hours ago | parent [-]

Atlassian products (Jira Server) are no longer supported, and their more Enterprise offering dies in 2029, so everything is ending up in their cloud now yeah.

▲

egeozcan 3 hours ago | parent [-]

I know a lot of companies vibe-coding alternatives. I'm not an expert but it's perhaps even illegal for most European companies to migrate any customer data to Atlassian servers.

▲

StableAlkyne 6 minutes ago | parent | next [-]

This is something I keep struggling with.

If someone wants to vibe code an alternative to a SaaS tool, my gut feeling is "no, this is bad and it will blow up" as vibe-coded projects tend to do.

But then the alternative is often paying $X million per year for licenses to a half-assed program that hasn't had a UI update since 2005.

I just don't have a good argument on why they shouldn't when the outcome will be just as dogshit, only cheaper and flashier.

▲

griffiths 3 hours ago | parent | prev | next [-]

Can you give more information on "illegal for most European companies" part? Asking for a EU company using Jira :)

▲

Sebguer 2 hours ago | parent [-]

This person is just posting absolutely baseless claims, as if Atlassian, a company that basically exists purely on the back of B2B SaaS sales, has not considered EU data residency requirements in their core product offering: https://www.atlassian.com/software/data-residency

	▲	jamesfinlayson an hour ago \| parent [-]
		Yeah I thought Jira at least was all built on AWS these days. I've never set up a Jira Cloud instance but I'd be surprised if you don't chose where your data lives.

▲

bombcar 3 hours ago | parent | prev [-]

This is how SaaS dies, vibe-coded to death.

I’m doing my part!

▲

milkshakes 4 hours ago | parent | prev | next [-]

this is a really bad look in 2026 imo

https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-fo...

> We have not requested CVE identifiers in Ruby for these fixes, at least for now.

> Ruby has generally considered it unsafe to compile and use a regular expression created from untrusted input. We stated this in the advisory for CVE-2022-28738, where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment. We did the same for CVE-2024-27282.

▲

couchand 4 hours ago | parent [-]

It's a Bad Idea (TM) to compile a regular expression from an untrusted input.

Despite what anyone would try to sell you, a regular expression is a programming language. It's Always A Bad Idea (TM) to compile untrusted input into any kind of programming language. Don't string concatenate SQL queries, eval is evil, it's all the same idea.

	▲	Blackthorn 2 hours ago \| parent \| next [-]
		A regex might be a programming language, a proper regular expression (which there are libraries for, like Google RE2) is just a regular language and I don't think you can even charitably call that a programming language.
	▲	milkshakes 26 minutes ago \| parent \| prev [-]
		> It's a Bad Idea (TM) to compile a regular expression from an untrusted input. i agree with you! nevertheless, > where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment not sure what sort of comprehensive assessment is still called for at this point?

▲

0x1F8B 3 hours ago | parent | prev | next [-]

> I really can't think of a decent solution for those people other than being plugged in 24/7 to the latest news which is really unfortunate and must be exhausting

The future is near constant burning of tokens in your software factory to do this automatically. The labs create the increase in demand for their own product.

▲

pixl97 3 hours ago | parent | next [-]

Turns out building the world on an infrastructure of lies has finally caught up with us.

The way LLMs are developed now is but one possible future we could have experienced. Imagine the future where the LLMs were built by a few governments with black budgets and hidden until a war or some other large event broke out. Then suddenly most of the computers and digital infrastructure shits itself as everything goes wonky.

At least this way we get to see that a shared global infrastructure built on the idea that security is someone else's problem was a really bad idea and we might have enough time to fix it or pull enough plugs we don't go back to the dark age.

▲

Gigachad 3 hours ago | parent | prev [-]

That's a for now problem. The future is probably less software surface area exposed to the internet, the removal of unsafe languages from software exposed to the network, services like Cloudflare deploying firewalls to detect exploit attempts, and services that can keep a live database of currently active bots and residential proxies to IP block them.

Alongside the current scanning and patching of software.

▲

0x1F8B 3 hours ago | parent [-]

I don't disagree. Also probably more logs and more metrics since LLMs can scale instrumentation, signals and auditing far beyond what humans could ever process, which in turn, more tokens. Probably larger Datadog bills too.

	▲	esseph 2 hours ago \| parent [-]
		> Probably larger Datadog bills too. I don't think that lasts, I've seen at least 5 viable replacements now. All internal projects at major US companies.

▲

edoceo 5 hours ago | parent | prev | next [-]

The PHP2Shell one was both lucrative and exhausting. I maintain a bunch of legacy PHP apps.

▲

weinzierl 4 hours ago | parent | prev | next [-]

At the beginning of the industrialization there were many accidents with steam boilers.

We've git that under control with regulation and the help of organizations, some of which still exist today.

This "era of constant exploits/patches" is not normal and can't go on. Currently it is an ongoing cat and mouse game, but it doesn't have to be.

	▲	bombcar 3 hours ago \| parent \| next [-]
		What’s interesting with steam boilers and other types of OSHA related injuries is that it’s not enough that the person who’s doing the stupid thing dies: you have to enforce it even more and even higher. People won’t value their life.
	▲	esseph 2 hours ago \| parent \| prev [-]
		> This "era of constant exploits/patches" is not normal and can't go on. Currently it is an ongoing cat and mouse game, but it doesn't have to be. Security is always reactive by its very nature. You can do proactive things, but you will always be reactive to novel attacks. Expect everything to have various levels of rolling upgrades, and soon. That's a lot of work.

▲

rconti 4 hours ago | parent | prev | next [-]

The world has changed but 15 years ago we thought it was utterly insane to just pull whatever $latest from $internetsite.probablytrusted.org as part of your build and deployment process.

▲

jayd16 3 hours ago | parent | prev | next [-]

Dynamically linked dependencies? CI and semver aware automatic dependency tracking? Automatic updates pointed at personal app depots?

▲

esseph 5 hours ago | parent | prev | next [-]

It's not maintainable unless you autobuild, and yes, upgrade treadmill.

▲

Gigachad 4 hours ago | parent [-]

The patch for Ruby came out 6 days ago. Most Rails apps do not use the Ruby from the package manager but have a hardcoded version in the repo. So unless you have developers releasing a PR to update ruby the moment it comes out, you aren't safe.

This might feel like a "Yeah obviously" moment, but the fact is that very few Rails apps are running the latest ruby release the moment it comes out.

	▲	edoceo 4 hours ago \| parent [-]
		True for many others right? PHP, Python, JS, Lua..what if some finds an old exploit in Perl, oh heck.

▲

awesome_dude 4 hours ago | parent | prev [-]

> build from source or make their own images vs those who rely on provided images and upgrade them often.

I mean - this incident brings it into sharper focus - but it's always been thus.

As a Go developer I often tell people "Be wary of vendoring, you are creating a cache of dependencies that need to be managed and maintained"

Or people that "pin" dependencies, they face the same difficulty.

Why not just use "official" (in this case) images - sometimes they lag too - hell, most Linux distributions lag so much with Go compiler packages that, again, I routinely tell people to avoid them in favour of watching the Go official page