Good morning!

GitLab ships a CVSS 10.0 in the compiler behind its CI/CD pipelines, and LG televisions fall to an unauthenticated root chain. Unauthenticated and unattended: the two hardest words in a patch note.

Here are the 6 things you don't want to miss:

1. 🔒 GitLab scores a 10.0 in the CI/CD compiler

GitLab shipped a critical patch release for CVE-2026-97229, a CVSS 10.0 integer overflow in the CI/CD regular-expression compiler that, under certain conditions, could have let an unauthenticated user execute arbitrary code. GitLab says the flaw is fixed in 19.4.2, 19.3.5 and 19.2.8, all released October 12; the release notes list 24 CVEs, five of them high severity. Self-managed instances carry the exposure until upgraded. The compiler flaw outranks everything else in the release. (GitLab release notes)

2. 🤝 Practice the Thing You Just Read About

Every item above is something you will eventually have to do, not just read about. Threat Road's Cyber Security Labs give you an isolated VM, a guided exercise, and a target that only exists for you to break — Linux fundamentals through hands-on exploitation, in your browser, on your own schedule. No shared infrastructure, no waiting for a lab window, no permission slip. (Threat Road)

3. ⚖️ Norway's record fine lands on Microsoft's ad arm

Norway's Data Protection Authority said it fined Xandr, Microsoft's ad arm, NOK 92 million for sharing Grindr users' data, including information revealing sexual orientation, through real-time auctions from July 2018 to April 2020. Announced October 12, the decision gives Xandr three weeks from receipt to appeal; Microsoft says the conduct predates its acquisition. The case began with a January 2020 complaint from noyb and Forbrukerrådet. Real-time bidding still prices sensitive data by the millisecond. (Datatilsynet)

4. 📺 A sync-demo app roots LG televisions, researchers say

SSD Secure Disclosure researchers reported an unauthenticated remote-code-execution chain against LG webOS televisions: a replayed LG-signed manifest in the sync-demo app bypasses client-key issuance, a server-side request forgery then reaches a log daemon running as root, where command injection lands. The chain was demonstrated on webOS 7.5.7-25 sets, and LG says it has issued a fix; the researchers said no user interaction is needed. (SSD Disclosure)

5. 🧩 IonQ buys its way into zero trust

IonQ, a quantum-computing company, announced an all-stock acquisition of Elisity, a zero-trust microsegmentation startup, worth up to $1.3 billion including up to $150 million in earnout. IonQ said the deal is expected to close in Q4 2026, subject to regulatory approvals, and put Elisity's footprint at more than 100 deployments. Buying the zero-trust story beats building it. (IonQ)

6. 📋 Thirty-one CVEs surface a month after MarkLogic shipped its fixes

Progress published its October MarkLogic security bulletin on October 12: 31 CVEs, five of them critical, including a 9.9-severity XQuery injection tracked as CVE-2026-85948. The fixes shipped earlier — September 10, in MarkLogic 11.3.7 and 12.1.0 — so this is disclosure catching up, not an unpatched emergency. Late bulletins turn patches into standing exposure. (Progress)

Bonus. Threat Road Tip Of The Day

Pin your vendor advisory pages in one browser tab group with a standing five-minute slot on the calendar. A bulletin like today's MarkLogic list is late to everyone who wasn't looking.

Disclosure: Topic #2 in this newsletter is a promotion for Threat Road's Cyber Security Labs. Nothing else in this issue is sponsored.