Podcast Detail

SANS Stormcast Tuesday, October 13th, 2026: GitLab CI/CD RCE (CVE-2026-97229); Let’s Encrypt 64-Day Certificates; Midnight Mimosa Pre-Installed Android Malware; Progress MarkLogic Patches

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10134.mp3

previous
Podcast Logo
GitLab CI/CD RCE (CVE-2026-97229); Let’s Encrypt 64-Day Certificates; Midnight Mimosa Pre-Installed Android Malware; Progress MarkLogic Patches
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

In today's episode: a critical GitLab integer overflow that allows unauthenticated code execution, Let’s Encrypt moving to 64-day TLS certificates in February 2027, Midnight Mimosa malware pre-installed on cheap Android phones, and Progress MarkLogic security updates.

CVE-2026-97229 - Integer Overflow Issue in CI/CD Regular Expression Compiler Impacts GitLab CE/EE
An integer overflow in GitLab's CI/CD regular expression compiler lets unauthenticated users execute arbitrary code on self-managed GitLab servers. It was reported responsibly through HackerOne, and no public exploit is known yet. Patch on-premises installations quickly.
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/#cve-2026-97229---integer-overflow-issue-in-cicd-regular-expression-compiler-impacts-gitlab-ceee

Let’s Encrypt 64-Day Certificate Lifetimes Coming Feb 2027
Let’s Encrypt staging certificates drop to 64 days on October 14th, and all new production certificates follow on February 10th, 2027. Test your automation now, and adjust certificate expiration alerts for shorter-lived certificates.
https://letsencrypt.org/2026/10/07/64-day-certs.html

Midnight Mimosa: Malware Pre-Installed on Android Phones
Bitdefender found Midnight Mimosa malware pre-installed on cheap Android phones sold under flagship-like names such as S25 Ultra and i17 Pro. The malware disables the Google Play Store to evade detection and supports clickjacking, a proxy botnet, and ad fraud.
https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware

Progress MarkLogic Critical Security Alert Bulletin – October 2026
Progress released October 2026 updates for the MarkLogic data management platform and NoSQL database, with some vulnerabilities rated CVSS 9.9. The most severe let users with low-level query privileges execute arbitrary code, partly through a legacy API that is still enabled.
https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

no transcript found