GitLab has published the release notes in the meantime.

The main issue addressed is related to CVE-2026-111943, removing trust for compromised eMudhra intermediate CA certificates.

Under certain conditions, attackers could exploit these compromised certificates to impersonate external services that GitLab connects to over TLS, potentially allowing them to intercept or manipulate communications. This is not a directly exploitable vulnerability in GitLab’s web interface.

The release notes...

What happened

The PHP project has published a security release fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS 9.2 (v4.0). They can be exploited remotely and without authentication, and can lead to remote code execution on the affected server. All PHP installations that serve web requests are affected (PHP-FPM, Apache with mod_php, php-cgi and others).

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer...