Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

2026-07-25T13:24:10Z35acac08d8cda02d5a80867cc03e6af607cf1d70ed7a165a0e9c0b74e4bfe13f
active-directoryactive-exploitationagentforgerai-agent-securitybing-imagescertighostcheck-pointcl0pcvedcsyncgitlabkerberoslinux-kernelmicrosoftopenaipatchphishing campaignsprivilege-escalationproof-of-conceptransomwarerceredisrefluxfssvgzero-day

What happened

Multiple high-impact vulnerabilities and active exploitation campaigns were reported across cloud, on-prem, and AI platforms. Notable items include a published PoC for a patched GitLab RCE affecting self-managed 18.11.3 servers (allows authenticated users who can push to run commands as git); Certighost (privilege-escalation/impersonation in Active Directory enabling DC certificate issuance and DCSync); OpenAI AgentForger (phishing link could build/authorize rogue ChatGPT Workspace agents; patched); Bing Images SVG flaws allowing commands as NT AUTHORITY\SYSTEM/root (Microsoft issued critical,

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
the_hacker_news
Record identifier
35acac08d8cda02d5a80867cc03e6af607cf1d70ed7a165a0e9c0b74e4bfe13f
Enrichment time
2026-07-25T13:24:10Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

Record · Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git · Baitaphish