Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
2026-07-25T13:24:10Z•35acac08d8cda02d5a80867cc03e6af607cf1d70ed7a165a0e9c0b74e4bfe13f
active-directoryactive-exploitationagentforgerai-agent-securitybing-imagescertighostcheck-pointcl0pcvedcsyncgitlabkerberoslinux-kernelmicrosoftopenaipatchphishing campaignsprivilege-escalationproof-of-conceptransomwarerceredisrefluxfssvgzero-day
What happened
Multiple high-impact vulnerabilities and active exploitation campaigns were reported across cloud, on-prem, and AI platforms. Notable items include a published PoC for a patched GitLab RCE affecting self-managed 18.11.3 servers (allows authenticated users who can push to run commands as git); Certighost (privilege-escalation/impersonation in Active Directory enabling DC certificate issuance and DCSync); OpenAI AgentForger (phishing link could build/authorize rogue ChatGPT Workspace agents; patched); Bing Images SVG flaws allowing commands as NT AUTHORITY\SYSTEM/root (Microsoft issued critical,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 35acac08d8cda02d5a80867cc03e6af607cf1d70ed7a165a0e9c0b74e4bfe13f
- Enrichment time
- 2026-07-25T13:24:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.