Episode Details

SANS Stormcast Tuesday, October 13th, 2026: GitLab CI/CD RCE (CVE-2026-97229); Let's Encrypt 64-Day Certificates; Midnight Mimosa Pre-Installed Android Malware; Progress MarkLogic Patches In today's episode: a critical GitLab integer overflow that allows unauthenticated code execution, Let's Encrypt moving to 64-day TLS certificates in February 2027, Midnight Mimosa malware pre-installed on cheap Android phones, and Progress MarkLogic security updates. CVE-2026-97229 - Integer Overflow Issue in CI/CD Regular Expression Compiler Impacts GitLab CE/EE An integer overflow in GitLab's CI/CD regular expression compiler lets unauthenticated users execute arbitrary code on self-managed GitLab servers. It was reported responsibly through HackerOne, and no public exploit is known yet. Patch on-premises installations quickly. https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/#cve-2026-97229---integer-overflow-issue-in-cicd-regular-expression-compiler-impacts-gitlab-ceee Let's Encrypt 64-Day Certificate Lifetimes Coming Feb 2027 Let's Encrypt staging certificates drop to 64 days on October 14th, and all new production certificates follow on February 10th, 2027. Test your automation now, and adjust certificate expiration alerts for shorter-lived certificates. https://letsencrypt.org/2026/10/07/64-day-certs.html Midnight Mimosa: Malware Pre-Installed on Android Phones Bitdefender found Midnight Mimosa malware pre-installed on cheap Android phones sold under flagship-like names such as S25 Ultra and i17 Pro. The malware disables the Google Play Store to evade detection and supports clickjacking, a proxy botnet, and ad fraud. https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware Progress MarkLogic Critical Security Alert Bulletin – October 2026 Progress released October 2026 updates for the MarkLogic data management platform and NoSQL database, with some vulnerabilities rated CVSS 9.9. The most severe let users with low-level query privileges execute arbitrary code, partly through a legacy API that is still enabled. https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026 My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich keywords: gitlab; ci/cd; let's encrypt; tls certificates; midnight mimosa; android malware; marklogic