CISA added two actively exploited flaws to its Known Exploited Vulnerabilities catalog on Oct 29. Both carry a federal due date of Nov 1, 2026.

• GitLab CE/EE, CVE-2026-97229 (integer overflow, CWE-190): an unauthenticated user can run code on the GitLab server through a crafted regular expression in a CI/CD configuration. GitLab fixed it on Oct 12 in 19.4.2, 19.3.5 and 19.2.8 (CVSS 10.0). CISA marks forensic triage as required under BOD 26-04, so agencies must check for compromise, not just patch. CISA also notes that other products can be affected by the same underlying Ruby/Onigmo regex bug, and points to Ruby's Oct 23 fixes (3.3.13, 3.4.12, 4.0.9).
• Cisco Secure Firewall ASA and FTD, CVE-2026-76418: an unauthenticated remote attacker can reload the device through the Remote Access SSL VPN when a tunnel group uses secondary authentication. Cisco disclosed exploitation on Oct 28 (covered here earlier today). No forensic triage requirement.

Context: this is the first public confirmation of in-the-wild exploitation for the GitLab bug. Earlier this week Alpine Linux disclosed an attempted exploitation of its own GitLab, which ran on standard Ruby and stayed vulnerable after the GitLab upgrade. CISA has not said who is exploiting either flaw.

What to do: confirm every self-managed GitLab is on 19.2.8 / 19.3.5 / 19.4.2 or later (and on the later Oct 21 builds that fix CVE-2026-110264). If you build GitLab on your own Ruby, upgrade Ruby too. Because exploitation is confirmed, review instances that were unpatched after Oct 12 for compromise: GitLab's six published detections (Onigmo worker crashes, hostile regexps in CI lint) are a starting point. For ASA/FTD, see the Cisco item for fixed releases.