Major GitLab Bug And AI Virus Shock Security Teams News Summary

📝 Overview

Security issues dominate the bulletin, with a max-severity GitLab flaw enabling remote code execution across more than a decade of releases, a PHP exploit bypassing protections against remote code execution, and Microsoft attributing a ConnectWise breach to Chinese spies affecting 2,250 cloud tenants. In technology, Google is turning the infrastructure behind Gemini’s agents into a cloud service, while AI-designed systems drew scrutiny after one of them was shown to produce a virus capable of infecting a human.

Cybersecurity

VulnCheck researchers showed a new exploit for PHP2Shell that can achieve remote code execution on ASLR-enabled x86-64 servers running PHP’s recommended production setup. The disclosure follows patching of the critical PHP vulnerabilities and growing concern that attackers are actively developing ways to weaponise them.

PHP2Shell exploit bypasses protections designed to stop remote code execution

Source: www.theregister.com - Articles • Published: October 22, 2026

GitLab patched a maximum-severity integer overflow flaw that could let unauthenticated attackers execute code on self-managed servers under certain conditions. The bug affects releases going back to GitLab 7.0, and the company urged customers to upgrade immediately.

Max-severity GitLab bug allows remote code execution over 12 years of releases

Source: www.theregister.com - Articles • Published: October 22, 2026

Health

Radical Numerics says it has given a patient a treatment containing AI-designed bacteriophages in what it describes as a first for human use. The lab says the viruses targeted an antibiotic-resistant bacterial infection, but it has not yet released results on the outcome.

Human receives AI-designed virus for the first time

Source: www.theregister.com - Articles • Published: October 22, 2026

Science

Japan’s Martian Moons eXploration mission has launched toward Phobos, with ESA’s Mars Express expected to support observations when it arrives. The mission aims to land on Phobos, collect samples and return them to Earth in 2031.

Veteran ESA probe rolls out welcome mat for Japan's Phobos mission

Source: www.theregister.com - Articles • Published: October 22, 2026

Security

AI agents complicate enterprise security because valid credentials do not always mean a valid action. The piece argues that security must move from one-time access checks to a continuous lifecycle that evaluates intent, policy, and action-level authorization.

AI agent security is a lifecycle — not a gatekeeper

Source: The New Stack | DevOps, Open Source, and Cloud Native News • Published: October 22, 2026

Technology

Researchers at Binghamton University demonstrated how a trojaned language model can manipulate robot task planning in simulation, producing unsafe instructions such as harming a hand model or misusing a kitchen robot. They also described a possible defence against the multi-trigger backdoor attack, called MuTRAP.

Backdoored robot tries its hand at finger chopping and cat cooking

Source: www.theregister.com - Articles • Published: October 22, 2026

Letta’s FrontierMemory benchmark tests whether AI agents can learn from past work, not just recall stored facts. Early results varied widely, with Letta Dream scoring highest and several other agent harnesses trailing behind.

Five AI agent harnesses took the same memory test. The results weren’t even close.

Source: The New Stack | DevOps, Open Source, and Cloud Native News • Published: October 22, 2026

DeepSeek’s V4.1-Flash-1017 and Anthropic’s Claude Haiku 5.5 are positioned as fast, low-cost models for routine tasks. Vendor-reported benchmarks and a small set of tests suggest DeepSeek may be more accurate, while pricing varies by prompt length and usage pattern.

DeepSeek V4.1-Flash-1017 vs. Claude Haiku 5.5: More accurate at a fraction of the price

Source: The New Stack | DevOps, Open Source, and Cloud Native News • Published: October 22, 2026

Google plans to offer Agent Compute Engine in Google Cloud, giving AI agents hardware-isolated microVM sandboxes. The move brings internal Gemini infrastructure to customers and reflects intensifying competition in agent hosting and sandboxing services.

Google turns the infrastructure behind Gemini’s agents into a cloud service

Source: The New Stack | DevOps, Open Source, and Cloud Native News • Published: October 22, 2026

Microsoft says China-aligned attackers used compromised ConnectWise credentials and AI tooling to target more than 2,250 Microsoft 365 tenants. The campaign rapidly escalated from password-spraying to attempts against cloud identities and privileged access.

Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants

Source: www.theregister.com - Articles • Published: October 22, 2026

A cybersecurity audit found a major US pharmacy chain had a Cisco firewall protected by the password “password.” The case highlights weak administrative controls on critical network equipment.

IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall

Source: www.theregister.com - Articles • Published: October 22, 2026