SANS Stormcast Tuesday, October 13th, 2026: GitLab CI/CD RCE (CVE-2026-97229); Let’s Encrypt 64-Day Certificates; Midnight Mimosa Pre-Installed Android Malware; Progress MarkLogic Patches

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10134.mp3

previous

GitLab CI/CD RCE (CVE-2026-97229); Let’s Encrypt 64-Day Certificates; Midnight Mimosa Pre-Installed Android Malware; Progress MarkLogic Patches

00:00

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

Login here to join the discussion.

Podcast Transcript

 Hello and welcome to the Tuesday October 13th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Amsterdam, Netherlands. And this episode is brought to you
 by the SANS.edu undergraduate certificate program in
 Cybersecurity Fundamentals. Let's start the day with
 GitLab. I don't cover every GitLab vulnerability, but this
 one does, I think, deserve a mention. It's an integer
 overflow issue in the CI/CD regular expression compiler
 and it does allow unauthenticated users to
 execute arbitrary code on the GitLab server. Given how
 critical GitLab is for organizations using it as part
 of their supply chain, it certainly must be addressed
 quickly. I'm not aware of an exploit being available
 publicly for this particular issue. It was reported
 responsibly by a researcher via HackerOne. So it wasn't
 something that was leaked first and then later published
 by GitLab. Only in fact, if you are running GitLab, of
 course, on-premise, if you're using GitLab's cloud
 solutions, that should not really be an issue. And Let's
 Encrypt published a blog post to prepare users of the
 reduced certificate lifetime coming up in February next
 year. Starting October 14th, so two days from now, the
 certificate lifetime of the staging environment will be
 reduced to 64 days. So that will give you a chance to
 experiment with it. But then starting February 10th next
 year, we'll see the same happening to any live
 certificates. So this will not affect certificates you
 already have, but then past February, any new certificates
 will only be valid for 64 days. And the blog post gives
 you a couple of tips on what to look for and how to get
 ready for these ever decreasing certificate
 lifetimes. I've been playing with the short-lived
 certificates from Let's Encrypt that are valid only 7
 days in one of my domains now. I think that's a worthwhile
 experiment for you to conduct where you basically set up one
 of the less important domains of you with these 7-day
 certificates. So to test that extreme case, pretty easy to
 do that. And one of the things that I noted was any kind of
 alerts you have that will tell you that a certificate is
 about to expire, you of course have to adjust them. Because
 many of them these days are going to trigger as soon as
 the certificate is only valid for 7 days. So you basically
 have a constant trigger in this particular case.
 Bitdefender has a real detailed nice write-up about
 malware that they discovered on certified pre-pwned Android
 phones. They call this Midnight Mimosa and again this
 comes pre-installed on the phone so there's nothing that
 the user would install. Interestingly, many of the
 affected phones try to mimic some of the flagship phones
 but are of course much cheaper and go by names like S25 Ultra
 or i17 Pro. Sort of mimicking some of the Samsung and Apple
 flagship phone names. Haven't seen a picture of the phone
 itself to see whether or not they mimic also the look of
 these phones. The malware is quite sophisticated and hard
 to detect by the user. It also selectively, for example,
 disables the Google Play Store in order to evade detection.
 And does offer features like clickjacking and a proxy
 botnet that an attacker could use to their advantage. And a
 number of other ways how they either inject ads or trick
 users to click on ads and that way increase their revenue.
 And finally for today, if you are using Progress Software,
 MarkLogic, Data Management Platform and NoSQL database.
 Well, they released their October 2026 updates. Some of
 the vulnerabilities are rated with a CVSS score of 9.9.
 However, most of them are sort of in the more privilege
 escalation of vulnerability scale. The more severe ones do
 allow users with the query ability, which is a fairly low
 level privilege in this system, to execute arbitrary
 code. So that's certainly something that should be
 addressed. Interesting also that some of these
 vulnerabilities stem from a legacy API that's still
 enabled in these systems. And well, so definitely apply the
 update as you get around to it. Well, and that's it for
 today. So thanks again for listening. Thanks for liking.
 Thanks for recommending. And well, special thanks also for
 any feedback that I receive as to which products I missed
 should have covered. Or which products maybe I should not
 have covered. Or any other mistakes or so. Please let me
 know. And that's it for today. Thanks and talk to you again
 tomorrow. Bye. Bye.