SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

SANS Stormcast Tuesday, October 13th, 2026: GitLab CI/CD RCE (CVE-2026-97229); Let’s Encrypt 64-Day Certificates; Midnight Mimosa Pre-Installed Android Malware; Progress MarkLogic Patches

7 snips

Oct 13, 2026

A critical GitLab flaw enables unauthenticated code execution through CI/CD. Let’s Encrypt prepares to shorten certificate lifetimes to 64 days, putting automation to the test. Cheap Android phones arrive with Midnight Mimosa malware, while MarkLogic patches severe vulnerabilities that could lead to arbitrary code execution.

Ask episode

AI Snips

Chapters

Transcript

Episode notes

INSIGHT

GitLab Bug Enables Unauthenticated Server Takeover

GitLab’s CI/CD regular-expression compiler flaw enables unauthenticated arbitrary code execution on self-managed servers.
No public exploit is known; responsible HackerOne disclosure gives defenders time to patch before supply-chain attackers act.

ADVICE

Test Automation Before 64-Day Certificates Arrive

Test certificate automation against Let’s Encrypt’s 64-day staging certificates beginning October 14, 2026.
Production certificates issued after February 10, 2027 will use the shorter lifetime; existing certificates remain unaffected.

ANECDOTE

Seven-Day Certificates Expose Broken Expiration Alerts

Johannes Ullrich tested Let’s Encrypt’s unusually short seven-day certificates on one domain.
The experiment exposed expiration alerts that triggered continuously because they were designed around seven days remaining.

Get the Snipd Podcast app to discover more snips from this episode

Get the app

In today's episode: a critical GitLab integer overflow that allows unauthenticated code execution, Let s Encrypt moving to 64-day TLS certificates in February 2027, Midnight Mimosa malware pre-installed on cheap Android phones, and Progress MarkLogic security updates.
CVE-2026-97229 - Integer Overflow Issue in CI/CD Regular Expression Compiler Impacts GitLab CE/EE
An integer overflow in GitLab's CI/CD regular expression compiler lets unauthenticated users execute arbitrary code on self-managed GitLab servers. It was reported responsibly through HackerOne, and no public exploit is known yet. Patch on-premises installations quickly.
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/#cve-2026-97229---integer-overflow-issue-in-cicd-regular-expression-compiler-impacts-gitlab-ceee
Let s Encrypt 64-Day Certificate Lifetimes Coming Feb 2027
Let s Encrypt staging certificates drop to 64 days on October 14th, and all new production certificates follow on February 10th, 2027. Test your automation now, and adjust certificate expiration alerts for shorter-lived certificates.
https://letsencrypt.org/2026/10/07/64-day-certs.html
Midnight Mimosa: Malware Pre-Installed on Android Phones
Bitdefender found Midnight Mimosa malware pre-installed on cheap Android phones sold under flagship-like names such as S25 Ultra and i17 Pro. The malware disables the Google Play Store to evade detection and supports clickjacking, a proxy botnet, and ad fraud.
https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware
Progress MarkLogic Critical Security Alert Bulletin October 2026
Progress released October 2026 updates for the MarkLogic data management platform and NoSQL database, with some vulnerabilities rated CVSS 9.9. The most severe let users with low-level query privileges execute arbitrary code, partly through a legacy API that is still enabled.
https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026
My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich