GitLab RCE Exploit Code Published Following Patch Delay as Enterprise RCE Threats Escalate
Security researchers at depthfirst published working exploit code on July 24 for a remote code execution (RCE) vulnerability in self-managed GitLab software, according to reports from The Hacker News. The flaw, which GitLab patched six weeks earlier on June 10, impacts self-managed version 18.11.3 deployments that have not yet applied the vendor update. Under this vulnerability, any authenticated user with repository push permissions can execute system commands under the privileges of the git user. The attack chain involves committing a specially crafted Jupyter notebook and opening its commit diff, which leaks heap memory to facilitate command execution.
The release of public proof-of-concept (PoC) code significantly increases operational risk for administrators managing unpatched infrastructure. Once exploit details become public, threat groups routinely integrate the code into automated scanners to identify exposed instances. This development illustrates a recurring security challenge for IT managers: the critical window of vulnerability between a vendor issuing a software patch and technical details becoming publicly accessible to potential attackers.
This exposure coincides with a broader wave of unauthenticated exploitation across enterprise software stacks. Security firms ThreatBook and Imperva recently warned of live attacks targeting a critical flaw in Fastjson 1.x, Alibaba's JSON library for Java, as reported by The Hacker News. Tracked as CVE-2026-16723 with an Alibaba-assigned CVSS score of 9.0, the vulnerability allows malicious JSON requests to execute code in affected Spring Boot applications without authentication. Unlike the GitLab vulnerability, no official patch is currently available for Fastjson 1.x.
At the same time, threat actors are aggressively targeting other enterprise backend applications for extortion. Affiliates of the Cl0p ransomware campaign—also identified as Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest—are currently exploiting internet-exposed deployments of PTC Windchill and FlexPLM, according to The Hacker News. Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet to achieve unauthenticated remote code execution.
The cybercrime ecosystem supporting these intrusions continues to streamline operations. Intelligence from cybersecurity firm PRODAFT detailed by The Hacker News reveals that the DevMan ransomware-as-a-service (RaaS) scheme, tracked as Funky Mantis, relies on a centralized portal where affiliates manage payload builds, financial payouts, and victim tracking. Meanwhile, initial access tactics are also shifting; investigations by CTM360 cited by The Hacker News demonstrate that insurance-focused phishing campaigns have evolved from passive credential harvesting to real-time account hijacking.
For enterprise system administrators and operational teams, these concurrent developments demonstrate why rapid update cycles are essential. Organizations relying on self-managed GitLab installations should verify that servers are updated beyond version 18.11.3, audit repository access rights, and maintain strict patch management protocols across all internet-exposed backend services.