GitLab's Oct 12 critical patch release (19.4.2, 19.3.5, 19.2.8) fixes CVE-2026-97229, an integer overflow in the CI/CD regular-expression compiler that could let an unauthenticated user run code on the server through a crafted regex in CI/CD configuration (CVSS 10.0). Affected: 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2. GitLab.com and Dedicated are already patched; self-managed must upgrade. Rapid7 says it reproduced arbitrary code execution on an unpatched official CE image (Oct 13), and researcher CryptoCat published a Rapid7 PoC that reaches system() as GitLab's git user; that PoC requires write access to a public project. Censys counts 25,766 hosts running affected versions. No in-the-wild exploitation reported yet. The same release fixes CVE-2026-96893, a prompt-injection issue in GitLab Duo Agent Platform. Not on CISA KEV. Note: some posts cite 19.3.4; GitLab's fixed 19.3 build is 19.3.5. Update Oct 16: Rapid7 published a technical analysis with an end-to-end PoC that runs commands as GitLab's git OS user on the official 19.4.1 CE image with ASLR on. Its route needs the attacker to first push a malicious CI config and a specially named path to a public project, with only the final CI lint request unauthenticated, which Rapid7 notes conflicts with GitLab's no-privileges rating. Still no reported in-the-wild exploitation.