Breaking

Two LPAs, tropical depression monitored as southwest monsoon persists 36% of overnight stays in Austria by German guests Xsolla seeks to help Philippine indie studios go global Building permits for apartments in June 2026 rise 13.8% from year earlier Hong Kong’s dim sum bond market hits new heights as State Grid deal draws record orders CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE Asia is rearming fast – but counting the wrong kind of military power GitLab patches critical GraphQL flaw allowing unauthenticated project deletion Fake troops loot quake-hit homes in Japan’s Kumamoto Anthropic’s annualised revenue run rate hit $65 billion at the end of July The best time to buy bank shares Relay shuts AI automation service, founder joins Google Chrome Singapore banks post record profit as DBS, OCBC drive growth Indonesia raises gold export reference price 0.65% for second half of August Ekovest Bhd plans RM355.85m rights issue to fund LIKE and cut debt Kumpulan Kitacon 1H26 PAT Edges Up 8.7% To RM28.7 Million Ahmad Maslan: Contractors need to submit evidence of material price increases for VOP Millions of guns, repeated shootings: Thailand confronts limits of firearm control Indonesia's Lido SEZ and Trump-linked golf clubhouse resume construction after months of uncertainty Malaysia's first-half GDP growth of 5.7% beats central bank's 2026 target Two LPAs, tropical depression monitored as southwest monsoon persists 36% of overnight stays in Austria by German guests Xsolla seeks to help Philippine indie studios go global Building permits for apartments in June 2026 rise 13.8% from year earlier Hong Kong’s dim sum bond market hits new heights as State Grid deal draws record orders CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE Asia is rearming fast – but counting the wrong kind of military power GitLab patches critical GraphQL flaw allowing unauthenticated project deletion Fake troops loot quake-hit homes in Japan’s Kumamoto Anthropic’s annualised revenue run rate hit $65 billion at the end of July The best time to buy bank shares Relay shuts AI automation service, founder joins Google Chrome Singapore banks post record profit as DBS, OCBC drive growth Indonesia raises gold export reference price 0.65% for second half of August Ekovest Bhd plans RM355.85m rights issue to fund LIKE and cut debt Kumpulan Kitacon 1H26 PAT Edges Up 8.7% To RM28.7 Million Ahmad Maslan: Contractors need to submit evidence of material price increases for VOP Millions of guns, repeated shootings: Thailand confronts limits of firearm control Indonesia's Lido SEZ and Trump-linked golf clubhouse resume construction after months of uncertainty Malaysia's first-half GDP growth of 5.7% beats central bank's 2026 target

Economy

GitLab patches critical GraphQL flaw allowing unauthenticated project deletion

GitLab released an emergency security update on Aug 17 to address a critical GraphQL vulnerability that could let unauthenticated attackers modify or delete public projects without any user action.

Source: The Hacker News · August 18, 2026 at 8:01 AM · AI-assisted report

GitLab patches critical GraphQL flaw allowing unauthenticated project deletion

Photo: NASA Goddard Photo and Video via nasa (BY)

KUALA LUMPUR, 18 AUGUST 2026 —

Listen to this article

DomainFork Audio · read aloud

GitLab released an emergency security update on Aug 17 to address a critical GraphQL vulnerability that could let unauthenticated attackers modify or delete public projects without any user action.

Market Impact

The flaw, tracked as CVE-2026-19478 and rated Critical with a CVSS score of 9.4, affects self-managed installations running versions 18.11 through 19.2. Patches are available in GitLab 19.2.4, 19.1.6, 19.0.8 and 18.11.11, according to the company. GitLab.com and GitLab Dedicated already run the fixed code and require no action.

A second flaw, CVE-2026-19650 rated High at CVSS 7.1, was also fixed; it requires user interaction to exploit via a CSRF vector in GraphQL multiplex query handling, GitLab said. Neither flaw has seen public exploitation or exploit code as of Aug 18.

Full technical details will be published on Nov 16, 30 days after the June 10 patch release that shortened GitLab’s disclosure window from 90 to 30 days. GitLab said the update introduces no new migrations and should not require downtime on multi-node deployments.