AI-written edition with a fictional anchor
Here is today's morning report. Tue, Sep 15, 06:26 HKT
- 06:10 HKT GitLab's Perfect-Score Path Traversal Hits Two Repo Platforms At Once Kai Tanner has the full picture on GitLab's perfect-score flaw and the Gitea bug already being exploited in six countries.
- 06:10 HKT Beijing Uses Claude AI To Probe Taiwan's Defenses Mei Chen reports Beijing used Claude to automate reconnaissance against Taiwan's defense networks, running underneath this week's summit diplomacy.
- 06:11 HKT China's War-Footing Order Lands On A PLA Procurement Ledger Vincent Lai reads China's war-footing order as a procurement instruction to state planners, not a message timed for Washington.
- 06:12 HKT SFC Bans, Suspends, Skips the Disclosure Story Rachel Lam on a quiet enforcement week at the SFC and the one deadline, 31 May 2026, that the silence doesn't excuse.
- 06:12 HKT A Second Brain Implant Finally Reads Imagined Speech Magnus Honeyfield on a wireless implant that produced fluent speech from imagined words alone, no attempted articulation required.
- 06:12 HKT Erling Haaland Sets Manchester Derby Scoring Record Dev Chatterjee on Haaland's derby scoring record, and the two VAR officials stood down in the same 90 minutes.
Continue reading
GitLab And Gitea Bugs Put Repos Under Siege
A perfect-score GitLab flaw and active Gitea exploitation across six countries mean the code repository, not the perimeter firewall, is this week's real attack surface.
The number to sit with is ten, as in a perfect 10.0 CVSS score, and it belongs to CVE-2026-85706, a path traversal flaw in GitLab Community and Enterprise Edition. Path traversal means an unauthenticated request can walk out of the web root and read whatever the GitLab process can see: source code, CI/CD secrets, SSH keys, deployment tokens sitting in commit history nobody scrubbed. CISA issued its own alert. HKCERT's bulletin the same week bundles it with separate GitLab flaws enabling remote code execution and cross-site scripting, so an exposed instance this week faces all three at once.
What showed up alongside it is why this is a story and not a routine patch note. The Hacker News reported a suspected Chinese group tracked as Red Heron already exploiting a Gitea remote code execution bug live, thirteen organizations breached across six countries. Different product, different vendor, same category of target: internet-facing code repository infrastructure that most security teams still file under internal tooling rather than perimeter defense. Kai Tanner's Cyber Intel desk has the full audit trail: GitLab is disclosed with no confirmed exploitation yet, Red Heron's Gitea campaign is already running.
A self-hosted GitLab instance is not an internal dev tool this week. It's a server holding the keys to production, and Red Heron has already shown what happens to the version of this bug that gets exploited before anyone patches. Patch on the assumption that the disclosure and the exploitation report arrive in the wrong order, because for Gitea's thirteen victims, they already did.
All episodes and how to subscribe →