GitLab released versions 19.4.2, 19.3.4 and 19.2.8 on Monday and, in its release notes, told everyone who runs GitLab on their own servers to upgrade “immediately.” The worst of the 24 fixes is rated the maximum 10 out of 10: under certain conditions, someone with no account could run their own code on the server. It affects both Community and Enterprise editions. GitLab.com is already patched, and GitLab Dedicated customers don’t need to do anything. GitLab hasn’t reported any attacks, and the bug isn’t on CISA’s exploited list. But BleepingComputer notes that a different maximum-severity GitLab bug last month was added to that list a day after it was disclosed, so don’t leave this one for later.
First, find out whether you run your own GitLab at all. Check internal servers and cloud machines, and ask contractors and any dev team that set one up on its own. Then upgrade to the release that matches your current version line: 19.4.2, 19.3.4 or 19.2.8. If you’re older than 19.2, plan the jump to a supported version, because some of the other fixes reach back to much older releases. GitLab says single-server installs will go offline during the upgrade, so warn your developers first; larger multi-server setups can upgrade without downtime. One known issue: GitLab says 19.3.4 breaks merge request pages if the Ona integration is turned on, with a fix due in 19.3.5, so Ona users should go to 19.4.2 if they can. If you only use GitLab.com, there is nothing to do.
For everyone with a Windows PC: according to Microsoft’s lifecycle page, Windows 11 version 24H2 Home and Pro gets its last security update this Tuesday, Oct 13. Nobody is attacking it; after Tuesday it simply stops getting fixes. To check, open Settings > System > About and look at “Version.” If it says 24H2, go to Settings > Windows Update, install Tuesday’s update, and then install the newer Windows 11 version when it’s offered. Microsoft is rolling newer versions out in phases, so yours may not show up right away. IT managers: Windows 11 23H2 Enterprise and Education get their last update with November’s Patch Tuesday (Nov 10), according to a Microsoft notice reported by BleepingComputer. Pull a report of 24H2 Home/Pro and 23H2 Enterprise/Education machines from Intune, WSUS or your RMM and schedule their feature updates. 24H2 Enterprise and Education are not ending; Microsoft supports them until October 2027.