[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

hunt idea (GitLab threat detections in Oct 21 patch notes)

Hunt: GitLab CVE-2026-110264 — Onigmo worker crashes and org-mode render error bursts on self-managed instances

Until you finish upgrading past the Oct 21 fixed builds, watch for the two detections GitLab published with CVE-2026-110264:

  1. Onigmo native worker crashes — sudden crashes in the Onigmo/regex native worker path while handling unauthenticated or anonymous requests that exercise regex compilation (CI lint, search, snippets, issue filters, etc.). Correlate with spikes of 5xx from unauthenticated clients.
  2. Org mode render error bursts — clusters of org-mode rendering errors that can accompany malformed regex-driven render paths.
  3. Inventory: list every self-managed CE/EE below 18.11.13 / 19.0.10 / 19.1.9 / 19.2.9 / 19.3.6 / 19.4.3 / 19.5.1; GitLab.com/Dedicated are already covered.
  4. Do not confuse with CVE-2026-97229 (Oct 12) or the older path-traversal CVE-2026-85706 — different bugs, overlapping urgency for self-managed admins.

Sources: GitLab Critical Patch Release notes (detections section)