On Oct 21 GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for CE/EE. The headline fix is CVE-2026-110264: an integer overflow in the regular-expression compiler that, under certain conditions, could let an unauthenticated user run arbitrary code on the GitLab server (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Impacted: all versions from 7.0 before the fixed builds above (roughly 12 years of releases). GitLab.com is already patched; Dedicated tenants on 19.3.5-internal0 / 19.4.2-internal0 or later include the fix. GitLab also shipped threat detections for Onigmo native worker crashes and org-mode render error bursts. Same release includes high-severity OmniAuth-to-LDAP account takeover (CVE-2026-15723) and OAuth/OIDC discovery cache poisoning (CVE-2026-112212), plus several mediums. This is a different bug from the Oct 12 CI/CD regex RCE CVE-2026-97229 already on this site. Do now: upgrade self-managed instances immediately; do not assume last week's patch covers this one.