GitLab Max-Severity RCE, JFrog Artifactory Backdoor, and Retail Supply Chain Disruption

Three critical incidents with direct supply chain implications dominate today’s threat landscape. GitLab has issued an emergency warning for a maximum-severity unauthenticated remote code execution vulnerability in its CI/CD Regular Expression Compiler, requiring immediate patching. Meanwhile, Wiz Research confirms active in-the-wild exploitation of three JFrog Artifactory vulnerabilities being chained to deploy a Rust-based backdoor with full administrative access. In the retail sector, Ahold Delhaize has taken systems offline following a cybersecurity incident, with potential knock-on effects for suppliers and logistics partners across Europe and North America. All three incidents highlight a common theme: attackers are targeting developer and software management infrastructure that often sits outside standard vulnerability management programmes. UK small businesses face indirect but material risk through their IT providers, MSPs, and software suppliers. The episode examines what these incidents mean for organisations without direct control over the affected infrastructure, and how to verify patching status and supply chain exposure when you rely on third parties for critical services.

Chapters

• Introduction Opening summary of three supply chain-focused incidents requiring immediate attention, with emphasis on active targeting of software build infrastructure.
• GitLab Max-Severity RCE Emergency warning for unauthenticated remote code execution vulnerability in GitLab CI/CD Regular Expression Compiler. Explains CI/CD pipeline risk, the specific flaw, patching urgency, and how to verify MSP response.
• Call to Action Brief listener engagement prompt encouraging show following and sharing with colleagues and suppliers.
• JFrog Artifactory Active Exploitation Active in-the-wild exploitation of three chained JFrog Artifactory vulnerabilities deploying a Rust-based backdoor. Details the three-step attack chain, payload characteristics, and indirect supply chain exposure for UK SMBs.
• Ahold Delhaize Retail Incident Cybersecurity incident at major food retail group Ahold Delhaize prompts system shutdowns. Examines scale, containment measures, and knock-on effects for suppliers, logistics partners, and payment processors in the supply chain.
• The Wider Picture Analysis of NCSC external attack surface management consultation in context of today’s incidents. Highlights gap between standard vulnerability management and developer infrastructure, and the implications for UK SMBs relying on third-party providers.
• Closing Summary of supply chain attack concentration and advice on verifying patching evidence from IT providers rather than accepting assumptions.

Links

• https://about.gitlab.com/releases/2026/10/12/security-release-gitlab-17-5-1-released/
• https://www.wiz.io/blog/jfrog-artifactory-vulnerabilities-exploited-in-the-wild
• https://www.aholddelhaize.com/newsroom/2026/10/12/cybersecurity-incident/
• https://www.ncsc.gov.uk/blog-post/external-attack-surface-management
• https://www.ncsc.gov.uk/collection/developers-collection/principles/protect-your-code-repository
• https://nvd.nist.gov/vuln/detail/CVE-2026-42016