Malik Haidar is a heavyweight in the cybersecurity arena, known for navigating the high-stakes world of threat intelligence for multinational corporations. With a career built on dismantling complex attack vectors and bridging the gap between technical defense and business strategy, he has a unique perspective on the evolving nature of digital warfare. As we look at the recent surge in critical vulnerabilities affecting development platforms, Malik provides the expert analysis needed to understand how these flaws are exploited and what organizations must do to survive an increasingly hostile landscape.
In your experience, how do high-severity path traversal vulnerabilities in repository APIs fundamentally change the threat landscape for unauthenticated users?
This specific vulnerability, tracked as CVE-2026-85706, creates a catastrophic opening where an attacker can sidestep all security protocols to peek into the server’s internal filing cabinet. By leveraging improper path confinement and a total lack of authentication enforcement in the repository commits API, an unauthenticated user can read arbitrary files, which often contain the “keys to the kingdom” like log files and GitLab-specific configuration data. It is a gut-wrenching scenario for a security team because it requires only one public project to exist for the entire instance to be vulnerable. We have observed threat actors using this access to dump secrets and SSH configurations, effectively turning a simple API flaw into a total system compromise with a perfect CVSS score of 10.0.
The timeline between the disclosure of these vulnerabilities and active exploitation seems to be shrinking; what can you tell us about the speed of these current probes?
The speed of modern exploitation is breathtaking, with probes for this flaw appearing at 06:00 UTC on September 11, just hours after the disclosure. This leaves zero room for the traditional, slow-moving patch cycles that many large corporations still rely on today. When an exploit moves from a behavioral probe to a full configuration dump in a single weekend, defenders are essentially forced into an emergency response mode from minute one. CISA’s decision to mandate fixes by September 14 for federal agencies underscores just how little time there is to act before the damage becomes irreversible.
Beyond just stealing files, what are the broader strategic risks when a platform like GitLab is compromised at this level?
GitLab is essentially the crown jewels of an organization because it houses the source code, CI/CD secrets, and the very blueprints of how a company’s software is built. If an attacker gains a foothold here, they can inject malicious code directly into the build pipelines, poisoning everything downstream in a classic supply chain attack. We have seen this tactic become a favorite for adversaries throughout this year because it allows them to bypass traditional perimeter defenses by riding along with trusted software updates. It isn’t just about stealing data; it’s about gaining the ability to control the software that the rest of the world trusts, which is exactly why these platforms have become such a massive focus for hackers.
There is also mention of an insecure deserialization bug affecting the Enterprise Edition; how does this vulnerability add another layer of danger for organizations?
The discovery of CVE-2026-87719, which carries a staggering CVSS score of 9.9, adds a dangerous internal dimension to the threat profile. By exploiting the Duo Chat feature through a specially crafted GraphQL subscription argument, an authenticated user can bypass serialization to perform server object lookups. This allows an attacker to potentially scoop up sensitive credentials and Advanced Search configurations that should be strictly off-limits. It serves as a stark reminder that even our productivity-enhancing AI tools can be turned into a back door for deep-seated information disclosure if they aren’t hardened against such sophisticated manipulation.
For organizations currently running self-managed instances, what specific investigative steps should security teams take right now to determine if they have been targeted?
Teams need to move past simple patching and start hunting for signs of entry by reviewing their log files for very specific indicators of foul play. You should be looking for HTTP POST requests directed at ‘/api/v4/projects/{id}/repository/commits/’ URIs that contain ‘file.Path’ parameters. If you see these, it’s a red alert that someone has been testing your defenses or already exfiltrating data. It is also critical to check for unauthorized dumping of configuration files and system SSH settings, as threat actors are currently using these to extract passwords and establish persistent access to the host.
What is your forecast for the security of DevOps environments?
I believe we are entering an era where DevOps tools will be the primary center of the bullseye for every major threat actor. As these platforms integrate more complex features like AI-driven chat and advanced search, the potential for high-severity vulnerabilities like the ones we’ve seen in versions 18.7 through 19.3.2 will only increase. Organizations will likely be forced to treat their development environments with the same level of paranoia they reserve for their production databases, implementing strict unauthenticated access controls and real-time monitoring. The battle for the supply chain is won or lost in the repository, and the current wave of mass exploitation is just the beginning of a much larger trend.
