Телеграм канал «Netlas.io»

CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264: Four CVEs in Ruby’s regular expression engine, discovered by GitLab, up to 10.0 rating 🔥

Last week, the Ruby team released patches for several bugs in Ruby’s regular expression engine (Onigmo). GitLab found that these bugs could be exploited for RCE on GitLab servers. The same risk applies to any other Ruby application that compiles user-supplied regular expressions.

Search at Netlas.io:
👉 Link: https://nt.ls/1j93T
👉 Dork: tag.name:"ruby"

Vendor's advisory:
https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/

CVE-2026-114625: Actively exploited SQL injection flaw in Arista VeloCloud Orchestrator, 9.9 rating 🔥

Arista has disclosed a new SQL injection vulnerability in VeloCloud Orchestrator that allows any authenticated user to gain operator privileges and impersonate a local user with "superuser operator" privileges. This issue is known to be actively exploited!

Search at Netlas.io:
👉 Link: https://nt.ls/Z5tBM
👉 Dork: http.body:"single-spa-application:@velocloud/vco-header" OR http.body:"vco/branding.css" OR http.body:"vco/favicon"

Vendor's advisory:
https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199

📟Fingerprinting Exposed Siemens S7 PLCs with Netlas

In 2010, Stuxnet targeted Siemens PLCs. More than fifteen years later, thousands of these devices still answer on TCP port 102 — openly revealing their model, firmware version, and even the internal names engineers gave them.

See how a few Netlas queries narrow thousands of exposed S7 services down to the ones worth a closer look — and reveal a surprising trait many of those responses share.

👉 https://netlas.io/blog/fingerprinting_exposed_siemens_s7_plcs_with_netlas/

🚧 Planned Maintenance 🚧
Short-term interruptions in service provision are possible❗️

On Saturday, October 24, at 06:00 UTC ⏰, we will carry out work on both replicas aimed at improving server stability and quality of service. The work will take about 2 hours, and short interruptions are possible during this time.

Please remember to save your work before this time.

🎥Turning Recon Data into Findings with Netlas

In his video, ZACK0X01 walks through the reconnaissance and scanning workflow behind his AI agent, showing how Netlas turns raw recon data into actionable findings.

You'll see how certificate and favicon hash searches can surface assets that subdomain enumeration misses, and how scanning turns a list of hosts into open services and technology fingerprints — with structured JSON output that's ready for automation.

👉 https://www.youtube.com/watch?v=v9v9eGpy87M

CVE-2026-110264 and others: 12 new vulnerabilities in GitLab, up to 10.0 rating 🔥

GitLab has disclosed 12 new vulnerabilities affecting GitLab CE & EE. The most severe allows an unauthenticated remote attacker to execute arbitrary code on the GitLab server.

Search at Netlas.io:
👉 Link: https://nt.ls/dxdTf
👉 Dork: http.title:"Sign in · GitLab" OR http.unknown_headers.key:"x_gitlab_meta" OR http.favicon.hash_sha256:72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef

Vendor's advisory:
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

CVE-2026-109618 & CVE-2026-109619: Two RCE vulnerabilities in PHP (PHP2Shell), rating 9.2 for both 🔥

Today the PHP security team released an emergency update addressing two critical vulnerabilities in the PHP core, which allow unauthenticated remote code execution as the web worker account.
Details of the two vulnerabilities were disclosed by researchers yesterday, ahead of today’s release.

Search at Netlas.io:
👉 Link: https://nt.ls/MDn37
👉 Dork: tag.name:"php"

Vendor advisories:
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp