Oh but wait: we are NOT done.
In the late morning, GitLab released a patch for an RCE of their own. Completely unrelated (it's not written in PHP). This one didn't have a severity of 9.2 - it had a severity of 10.
We run a sizeable GitLab server, it has 700 users and 2.5k repositories - this is the main thing we have to defend against bots, so we know that they know it's there. (The bots mostly spend their time downloading every diff between every revision of several copies of ... the Linux kernel. Super rare stuff, guys. Never before has so much dumb shit been done in service of "smart" technologies.)
So, we had it down within minutes. Updated and back up 15 minutes later.
Somewhere in this mess, I don't know exactly when, NodeJS releases patches for *their* own high-severity RCE. All supported versions (probably old unsupported ones too.) Again, completely unrelated.
Luckily, we only run one NodeJS thing, and could just firewall it off from everything but the one machine that needs to use it.
(I do, however, run some stuff in my homelab that uses NodeJS. I just pulled it all down, only brought back up the bits that had updated their container images.)
I had a chat with a potential collaborator, went to class, talked with a friend, went home, and fell asleep.
I didn't manage to get my Real Job, giving my feedback on one of my student's papers, done. I'll work on that when I'm done getting this out of my system.
Rob Ricci
npub19r…zcahj
2026-10-22 09:51:12 UTC
in reply to nevent1q…xl42
Author Public Key
npub19r2tuule098208u80kee76te0rt62gnrj3r35cdm7nwpq55vuvtszzcahjSeen on
wss://relay.momostr.pinkPublished at
2026-10-22 09:51:12 UTCEvent JSON
{
"id": "b40091b9a00d15955d65301935eeaab1f02d935721d5d71c2390145951df9ed5",
"pubkey": "28d4be73f9794ea79f877db39f697978d7a5226394471a61bbf4dc10528ce317",
"created_at": 1792662672,
"kind": 1,
"tags": [
[
"proxy",
"https://discuss.systems/@ricci/117483940901629320",
"web"
],
[
"p",
"28d4be73f9794ea79f877db39f697978d7a5226394471a61bbf4dc10528ce317"
],
[
"e",
"b49f6ce8610db8a7a25f1483d92663e1892d5d5778f8f20723614ffa8bbf0c70",
"",
"root",
"28d4be73f9794ea79f877db39f697978d7a5226394471a61bbf4dc10528ce317"
],
[
"e",
"a6a849e2aa620f631cf0a67f6a001604140f8b44fa9a4bc0ac531c8693bb6969",
"",
"reply",
"28d4be73f9794ea79f877db39f697978d7a5226394471a61bbf4dc10528ce317"
],
[
"proxy",
"https://discuss.systems/users/ricci/statuses/117483940901629320",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://discuss.systems/users/ricci/statuses/117483940901629320",
"pink.momostr"
],
[
"-"
]
],
"content": "Oh but wait: we are NOT done.\n\nIn the late morning, GitLab released a patch for an RCE of their own. Completely unrelated (it's not written in PHP). This one didn't have a severity of 9.2 - it had a severity of 10.\n\nWe run a sizeable GitLab server, it has 700 users and 2.5k repositories - this is the main thing we have to defend against bots, so we know that they know it's there. (The bots mostly spend their time downloading every diff between every revision of several copies of ... the Linux kernel. Super rare stuff, guys. Never before has so much dumb shit been done in service of \"smart\" technologies.)\n\nSo, we had it down within minutes. Updated and back up 15 minutes later.\n\nSomewhere in this mess, I don't know exactly when, NodeJS releases patches for *their* own high-severity RCE. All supported versions (probably old unsupported ones too.) Again, completely unrelated.\n\nLuckily, we only run one NodeJS thing, and could just firewall it off from everything but the one machine that needs to use it.\n\n(I do, however, run some stuff in my homelab that uses NodeJS. I just pulled it all down, only brought back up the bits that had updated their container images.)\n\nI had a chat with a potential collaborator, went to class, talked with a friend, went home, and fell asleep.\n\nI didn't manage to get my Real Job, giving my feedback on one of my student's papers, done. I'll work on that when I'm done getting this out of my system.",
"sig": "151ec707c5b0c9467eb80741aff28580571e6d21bd75a309d7bfac9c9f52d850b0287ca2a58e5309dd3f9af98fd9c5de4959b7cb94ffd74bcbe7257bae56e5cf"
}