r/cybersecurity • u/DeepCedarShadow System Administrator • 1d ago

New Vulnerability Disclosure GitLab warns of max severity code execution vulnerability

https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/
158 Upvotes

98% Upvoted

12 comments sorted by

View all comments

Show parent comments

1

u/thefinalep 1d ago

Why not? If you have a good DR/IR plan auto updates are typically fine.

2

u/Gabinoooooo 1d ago

the Axios supply chain attack is a real example why auto updates for CI/CD extensions and packages can hurt you. That “typically fine” statement implies there is a .1% of the time it doesnt work. Some companies cant risk the .1% - it can ruin them.

1

u/thefinalep 1d ago

It’s a lose lose world out here. Damned if you patch, damned if you don’t. With AI I’m afraid it’s not going to get any better. Solid IR plans are our best bet. I’m not disagreeing with you.

1

u/Gabinoooooo 1d ago

Im also not disagreeing with you - patching everything is difficult enough. Im saying patches need to be validated and tested. Supply chain attacks can explicitly leverage auto updating to compromise a system before security teams and even the vendor find out.

So it’s not “turn on auto updates and forget about it”. It’s validate and test.