Over 1,000 GitLab Servers Exposed to RCE Flaw as BTCPay Issues Alert

Enterprise DevOps administrators and open-source maintainers confronted active exploitation campaigns against self-hosted GitLab and BTCPay Server deployments on Monday, while encrypted software provider Proton reversed a controversial internal AI evaluation policy.

Over 1,000 GitLab Servers Remain Unpatched Against Exploited CVE-2026-97229 RCE Flaw

According to BleepingComputer, the Shadowserver Foundation is tracking more than 1,000 internet-exposed GitLab servers—primarily in the United States, Germany, Russia, France, and China—that remain unpatched against CVE-2026-97229, a high-severity integer overflow in GitLab's CI/CD Regular Expression Compiler that allows unauthenticated remote code execution (RCE):

• Oct. 12 Patches & CISA KEV Listing: GitLab—which serves more than 70 million registered users and over 50% of Fortune 100 companies—patched CVE-2026-97229 on Oct. 12, 2026 in Community and Enterprise Edition versions 19.4.2, 19.3.5, and 19.2.8 after security researcher st4nly0n reported the flaw via HackerOne. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities (KEV) catalog on Friday, giving federal agencies 2 weeks to patch.
• 11,300+ Servers Vulnerable to CVE-2026-110264: Out of roughly 39,000 unique GitLab instances observed online daily, Shadowserver also identified more than 11,300 servers still exposed to a separate critical vulnerability, CVE-2026-110264, patched in late October 2026.

BTCPay Server Urges Immediate Upgrade to v2.4.7 After Bitcoin and Litecoin Hot Wallet Drains

In a second urgent open-source security alert reported by BleepingComputer, BTCPay Server founder and lead maintainer Nicolas Dorier warned operators running version 2.4.1 (released July 23, 2026) or older to upgrade immediately to v2.4.7 after threat actors began draining online Bitcoin and Litecoin hot wallets. The underlying critical authentication and server flaw—originally disclosed and patched on Oct. 29, 2026 after being discovered with the help of Anthropic's Frontier open-source security scanner—allows unauthenticated attackers to compromise self-hosted instances that store private keys in active hot wallets; hardware and watch-only cold wallets are not affected.

Proton CEO Andy Yen Cancels Company-Wide AI "Re-Interviews"

Meanwhile, 404 Media reported Monday that Proton CEO Andy Yen canceled a planned company-wide "re-interview" process that would have evaluated existing employees on their adoption of artificial intelligence tools. Following 404 Media's reporting last week and pushback from both staff and privacy-focused Proton subscribers, Yen told employees the mandatory re-interviews would not proceed. Separately, the editorial noted that fanfiction archive Archive of Our Own (AO3) has entered a scheduled maintenance outage expected to last 2 weeks to 1 month.