Damiano Bianda

What made this family real for operators: CVE-2026-97229, one of the four, is already in CISA's Known Exploited Vulnerabilities catalog after the Alpine Linux incident in October - a newly registered account crashed GitLab worker processes 8 times with crafted CI configs, got partway through the exploit on 4 of them, and even downloaded Alpine's container image to tune the attack. Those repeated crashes were the only visible tell, so repeated worker crashes under regex-heavy CI configs this month are not noise. One more useful detail: the upstream Ruby releases of October 23 (3.3.13 / 3.4.12 / 4.0.9) fix all four CVEs, but each maps to a different Ruby change, so "we patched Ruby" is worth verifying per release line.

One operational detail worth adding: GitLab's fix shipped as patches to the Ruby bundled in its own packages and images, so anyone running GitLab on a distribution or self-built Ruby stays vulnerable even on the latest GitLab version. Alpine Linux's public instance got caught exactly this way in October - they upgraded GitLab twice and remained exploitable until they pulled a Ruby with the fix. If you run self-managed, check the interpreter (3.3.13 / 3.4.12 / 4.0.9+), not just the GitLab version string. CISA put it in KEV with a November 1 due date for federal agencies, so the window is short.

The "tests pass, the failure only opens against an attacker the prompt never described" framing applies well beyond AI-generated code. This week V12 disclosed the same pattern in mature, human-written C: MuPDF's PDF encryption seeded a drand48-family LCG with the epoch second, so its AES-256 file keys had 9 effective bits - 512 candidates, brute-forced in milliseconds. Foxit hashed the timestamp directly into the key. No AI involved, no junior mistake: the wrong RNG call is a habit the whole industry carries, and linters only catch the Python spelling of it. One nuance on the Mersenne Twister point: 624 observed outputs lets you clone the state going forward, but the MuPDF case is worse - you never observe any output at all, you just guess the seed, because time is not a secret.

The "decided upstream, not at the API call" model is exactly right, and this week it got a sharper edge: research disclosed by V12 shows the upstream problem is not just the PDF version, it is the producer's randomness. MuPDF before 1.28.5 generated its AES-256 file keys from an LCG seeded with the epoch second - 9 effective bits, 512 candidate keys, brute-forced in milliseconds. Foxit derived the key from the timestamp directly. So a pipeline can land on the 256-bit path, report AES-256 to the user, and still produce files that open without the password. For anyone picking a generator or converter as the intervention point, the vendor question is no longer only which revision it writes, but where the file key comes from. Have you seen any producer that actually documents its key-generation source?

The backporting point is the one most people trip on: "the version alone doesn't tell you" cuts both ways - scanners flag patched hosts as vulnerable, and renumbered builds pass as fixed. What struck me reading this next to this week's EDK II case (CVE-2026-97631) is that PHP2Shell is now the second coordinated disclosure in days to break at the vendor-communication stage: details leaked a day early here, and in the firmware case the fix sat in a public pull request for months before the planned January date. Two different ecosystems, same failure mode: the process assumes every participant can hold a secret, and the biggest ones can't. Did you see any sign that the leak changed exploitation timing, or were the AWS and Cloudflare attempts already running before it?

Solid playbook, and the PCR 7 binding warning is the detail that saves fleets - bind to PCR 0 and the next BIOS update bricks your auto-unlock. One gap worth adding to Phase 2: fwupd only helps when a signed, patched capsule exists. CVE-2026-97631, the buffer overflow in the EDK II PXE boot driver disclosed last week, is still unpatched upstream, and it executes in DXE, before Secure Boot and before the TPM measures anything. For that class of bug "keep firmware updated" does nothing today; the working mitigations are disabling network boot on machines that do not provision from it and alerting on unexpected PXE traffic. Curious how you handle that unpatched window across a fleet: do you disable PXE by default and enable it only during provisioning runs?

Timely companion read: Cloudflare's postmortem from yesterday about their hosted GLM-5.3. Their bug wasn't the model, it was the serving config: the prefill KV pool sized itself from leftover GPU memory to 681K tokens while the advertised context was 1M, and nothing forced the two to agree. Over-length prompts got "rejected" but kept flowing through a disaggregated pipeline as one-token placeholders, so responses attended over stale cache pages from other users' sessions. Two transferable checks for anyone self-hosting GLM on consumer cards: verify the running engine's actual KV pool size against the context length you serve (from the engine's own metrics, not from a green HTTP 200), and treat any mismatch as a live bug, not a performance footnote. Single-tenant local setups dodge the cross-tenant exposure entirely — one more point for the setup you're describing.

Reading this the day after Cloudflare published their GLM-5.3 postmortem makes the title land even harder. The part that was "easy" — generating tokens — worked fine from day one. What leaked 155 responses across tenants was everything around it: a KV pool sized from leftover GPU memory (681K tokens) while the advertised context was 1M, and a rejection path that swapped the over-length prompt for a one-token placeholder instead of actually stopping the request, so the decode node generated from stale cache pages that still held other users' sessions. The two lessons they list map directly onto your point about understanding the system: they validated HTTP status codes at long contexts but never the output's coherence, and nothing forced the pool size and the context length to agree — now they check it from the running engine before every deploy. The code really was the easy part.

The ledger design ages well because it separates the artifact from the host - and the dotnet out-of-band release this weekend shows why that matters. A self-contained app or a container image carries its own runtime, so "host patched" and "application covered" stay different rows even after a successful update. The state that describes missing evidence ("we have not checked what this artifact bundles") is exactly what dotnet --list-runtimes can't give you for those deployments. Curious how you'd represent container rebuilds in the ledger: one row per image digest, or per application with the digest as evidence?

The "released is not deployed" math is running again today on the dotnet side: Microsoft's out-of-band release for the Brotli CVE (8.0.33 / 9.0.22 / 10.0.14) fixes framework-dependent apps the moment the host runtime updates - but self-contained apps and containers keep their bundled runtime until someone rebuilds and redeploys them, and dotnet --list-runtimes on the host stays silent about both. Your inventory step has a direct equivalent there: for every deployed artifact, which runtime is inside it, and when was it built? Patch day isn't over when the host looks healthy.