Breaking

UMNO-PAS cooperation only to seize Anwar's power, using Malay unity as excuse – Amanah Malaysia knocked out of Merdeka Cup women's semifinals Outrage as China programmer’s toilet death ruled non-work-related for being ‘not at desk’Social assistance spending rises 6.1% in 2025 PalawanPay targets physical card rollout in Q4 Kelas Sekejap expands AI learning app to schools and enterprises Google offers 12-month free AI Plus subscription to Malaysian students Poverty rate falls to single digits in the Philippines as incomes outpace thresholds Chinese insurer Ping An eyes Hong Kong ETFs as Beijing greenlights cross-border investment SickKids discloses data breach exposing employee and job applicant details GitLab’s critical CVE-2026-19478 is under active exploitation within days of disclosure.Khazanah affirms governance push after third-quarter board meeting QR code payments launched for ShopeePay users in China Banjarbaru delays school start times as haze worsens Luxury sales drop more than 10% in China as tax crackdown bites CDL net profit surges 230.7% in first half on Lumina Grand recognition Trade Minister sets US$25 billion Trade Expo Indonesia 2026 target Teladan Group swings to RM9.31 million profit in 2QFY2026 on higher progressive billings AI Living @ i-City to launch in Shah Alam with four agencies Nevada approves 8,000 robotaxis for Tesla, Uber and Waymo UMNO-PAS cooperation only to seize Anwar's power, using Malay unity as excuse – Amanah Malaysia knocked out of Merdeka Cup women's semifinals Outrage as China programmer’s toilet death ruled non-work-related for being ‘not at desk’Social assistance spending rises 6.1% in 2025 PalawanPay targets physical card rollout in Q4 Kelas Sekejap expands AI learning app to schools and enterprises Google offers 12-month free AI Plus subscription to Malaysian students Poverty rate falls to single digits in the Philippines as incomes outpace thresholds Chinese insurer Ping An eyes Hong Kong ETFs as Beijing greenlights cross-border investment SickKids discloses data breach exposing employee and job applicant details GitLab’s critical CVE-2026-19478 is under active exploitation within days of disclosure.Khazanah affirms governance push after third-quarter board meeting QR code payments launched for ShopeePay users in China Banjarbaru delays school start times as haze worsens Luxury sales drop more than 10% in China as tax crackdown bites CDL net profit surges 230.7% in first half on Lumina Grand recognition Trade Minister sets US$25 billion Trade Expo Indonesia 2026 target Teladan Group swings to RM9.31 million profit in 2QFY2026 on higher progressive billings AI Living @ i-City to launch in Shah Alam with four agencies Nevada approves 8,000 robotaxis for Tesla, Uber and Waymo

Economy

GitLab’s critical CVE-2026-19478 is under active exploitation within days of disclosure.

According to cybersecurity firm watchTowr, the 9.4-CVSS code-injection flaw lets unauthenticated attackers rewrite or delete publicly accessible GitLab projects. The vulnerability can be triggered via a GraphQL directive, GitLab said in versions 19.2.4, 19.…

Source: The Hacker News · August 21, 2026 at 10:01 AM · AI-assisted report

IntelligenceDomainFork

Image: DomainFork

KUALA LUMPUR, 21 AUGUST 2026 —

Listen to this article

DomainFork Audio · read aloud

According to cybersecurity firm watchTowr, the 9.4-CVSS code-injection flaw lets unauthenticated attackers rewrite or delete publicly accessible GitLab projects. The vulnerability can be triggered via a GraphQL directive, GitLab said in versions 19.2.4, 19.1.6, 19.0.8 and 18.11.11.

Market Impact

watchTowr reproduced the issue minutes after disclosure and detected in-the-wild attacks against its honeypot network. Principal security researcher Jake Knott said AI-enabled attackers are compressing the time from disclosure to exploitation.

“Organizations that haven’t patched should hunt web logs for requests containing ‘@gl_introduced’,” Knott said. He also advised restricting unauthenticated access to “/api/graphql” or removing public repository access if patching is delayed.

The flaw can delete entire repositories and forge merge records to disguise failed fixes, watchTowr added. It urged organizations running internet-facing self-hosted GitLab instances to upgrade immediately.