$GTLB

GitLab (GTLB) reported Q2 revenue of $286.3M, up 21% YoY, and raised full-year guidance. Key highlights include record gross bookings, 42% net ARR growth, and strong first-order activity. Profitability exceeded expectations, with non-GAAP operating income of $42.6M. The company noted AI usage growth and early adoption of its Flex model.

Needham analyst Mike Cikos identified infrastructure software companies poised to benefit from enterprise AI adoption, including Dynatrace (Hold), Elastic (Hold), MongoDB (Buy), GitLab (Buy), ServiceNow (Buy), and Nutanix (Buy). Key developments: Dynatrace upgraded by Morgan Stanley, Elastic's Q1 revenue growth at 15%, MongoDB's Atlas platform grew 29% YoY, GitLab's Q2 results beat expectations, ServiceNow secured federal contracts, and Nutanix projected 11-13% revenue growth for FY2027.

GitLab disclosed a maximum-severity vulnerability (CVE-2026-85706) allowing unauthenticated file access. The flaw affects GitLab CE and EE versions and has been patched. Experts warn of severe risks, including credential theft, and advise immediate patching. The US CISA added the vulnerability to its catalog, noting active exploitation attempts.

GitLab released a critical patch for a maximum-severity flaw (CVE-2026-85706) in its repository commits API, which is being actively exploited. The vulnerability affects both Community and Enterprise Editions. U.S. authorities have set a remediation deadline for federal agencies. The patch addresses 17 other vulnerabilities, including a critical insecure deserialization flaw (CVE-2026-87719).

GitLab, a DevSecOps platform with 50 million users, is under active attack due to a critical path traversal vulnerability (CVE-2026-85706). The flaw allows unauthenticated attackers to access sensitive files and credentials. GitLab has released patches, and users are urged to update immediately. The U.S. Cybersecurity and Infrastructure Security Agency has set a deadline for federal agencies to patch the software.

CISA added GitLab's critical flaw CVE-2026-85706 to its KEV catalog, warning of active exploitation. The flaw allows unauthenticated file access. GitLab patched the issue in versions 19.3.2, 19.2.6, and 19.1. CISA urged agencies to update within three days. According to watchTowr, exploitation attempts are already observed.

GitLab patched a critical vulnerability (CVE-2026-85706) in its software, rated 10.0 on the CVSS scale, which allows unauthenticated attackers to access sensitive files. The US CISA confirmed active exploitation and added it to its Known Exploited Vulnerabilities catalog. Affected versions include GitLab Community and Enterprise Editions before 19.1.8, 19.2.6, and 19.3.2. GitLab.com and GitLab Dedicated customers are not at risk. CISA and security firm watchTowr urge immediate patching and monit

CISA added vulnerabilities in GitLab, JFrog Artifactory, and ConnectWise ScreenConnect to its KEV catalog. GitLab's flaw (CVE-2026-85706, CVSS 10.0) allows file access; JFrog's flaws (CVE-2026-42016, CVSS 8.1; CVE-2026-42018, CVSS 7.5) enable privilege escalation; ConnectWise's flaw (CVE-2026-84869, CVSS 9.9) permits unauthorized file execution. Exploits have been observed. Federal agencies must patch by September 14, 2026, for GitLab and ConnectWise, and by September 25, 2026, for JFrog.

CISA added a critical GitLab vulnerability (CVE-2026-85706) to its catalog, warning of active exploitation. The flaw affects GitLab CE/EE versions 18.7-19.3.1, allowing unauthenticated attackers to read arbitrary files. GitLab advises upgrading to patched versions. CISA set a remediation deadline of September 14, 2026, for federal agencies.

GitLab patched a critical path traversal vulnerability (CVE-2026-85706, CVSS 10.0) that allows unauthorized file access. Exploits began hours after disclosure. Affected versions include CE/EE 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The flaw impacts self-managed instances, with 20,000+ estimated at risk. GitLab.com is patched. The issue highlights structural concerns in GitLab's handling of untrusted file paths.