Will GitLab’s New Legal Chief Subtly Shift Its AI Growth Story Toward Governance First? (GTLB)

Depthfirst researcher Yuhang Wu reported a GitLab remote code execution path using two long-standing memory-safety flaws in the Ruby JSON parser Oj. GitLab parses .ipynb diffs with ipynbdiff, enabling authenticated users to submit crafted notebooks that can bypass ASLR and execute commands as the git user. Affected GitLab CE/EE: 15.2.0-18.10.7, 18.11.0-18.11.4, 19.0.0-19.0.1; fixed in 18.10.8, 18.11.5, 19.0.2. Oj affected 3.13.0-3.17.1; fixed 3.17.3.

Depthfirst researcher Yuhang Wu says an exploit chain in the Oj native JSON parser can enable remote code execution on default GitLab installs. The chain combines two long-persisting memory-safety flaws in Oj used by GitLab’s ipynbdiff for .ipynb diffs. Commands run as the “git” user, potentially exposing code and secrets. GitLab patched in 19.0.2, 18.11.5, 18.10.8; GitLab.com was already fixed.

GitLab cut 350 jobs (14% of staff) while reporting record Q1 FY2027 revenue of $264.2 million, up 23% year over year and about $10 million above analysts’ estimates, according to the company. It said customers paying over $100,000 grew 18% to 1,519 accounts. GitLab also plans to exit 22 countries and expects $30–$35 million in restructuring costs, including $19 million in Q2.

Simply Wall St reports that after GitLab’s Q1 fiscal 2027 results, analysts raised price targets and revised fair value. The fair value estimate increased from $30.30 to $33.52 (~10.6%). GitLab said Q1 revenue was $260.4M (+23% YoY) and updated FY27 guidance to $1.112B–$1.118B, while announcing “Act Two” restructuring (about 14% workforce reduction, exit 22 countries, $30M–$35M pre-tax charges).

GitLab reported fiscal Q1 results on June 2. Revenue rose 23% year over year to $264.2 million, above guidance of $253 million to $255 million. Subscription revenue increased 23% to $239.3 million; license revenue rose 25% to $24.9 million. The company guided fiscal 2027 revenue to $1.112 billion–$1.118 billion and adjusted EPS to $0.79–$0.82, and forecast Q2 revenue of $272 million–$274 million. It also plans a 14% workforce reduction and exiting 22 countries.

US stocks retreated as markets scaled back hopes for US-Iran peace. US MBA mortgage applications fell 2.5% (purchase -2.9%, refi -2.3%); the 30-year fixed rate dropped 8 bp to 6.57%. The Fed Beige Book was hawkish, citing slight-to-moderate growth and higher inflation; John Williams said no rate change is needed. Traders priced a 3% chance of a 25 bp hike.