Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
Read PostSecurity Labs
Learn about cybersecurity trends, best practices, and third-party threats to secure your code and digital infrastructure.
Featured post
Recent posts
Security Labs
PHP2Shell: GitLab helps find and remediate critical PHP flaws
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution. Learn which PHP versions fix them and how to check your projects.
Security Labs
DeepSeek-Reasonix: How a poisoned config can hijack an AI coding agent
GitLab's Threat Research Group found a flaw, ConfigPoisoning, that runs attacker code when a developer views a file's diff in DeepSeek-Reasonix.
Security Labs
Critical remote code execution in vm2, a widely used Node.js sandbox library
GitLab's Threat Research Group found a critical sandbox escape in vm2 that runs attacker code using the library's own documented configuration.
Security Labs
Critical remote code execution in Serena, a popular MCP coding agent
GitLab's Threat Research Group found a critical template injection in Serena that runs attacker code the moment a developer opens a repository.
Security Labs
A sandbox is only as closed as what an AI agent can reach
Stuck in an evaluation with no way out, an AI agent escaped in an hour through the one service on its allowlist. Here's the gap that opened.
Security Labs
Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting
GitLab’s Vulnerability Research team has uncovered a new Python supply chain attack targeting PyPI, deploying the Shai-Hulud worm to steal credentials from CI/CD systems.
Security Labs
How to detect and prevent Contagious Interview IDE attacks
Learn how we built custom controls that detect and prevent malware campaigns like those used for Contagious Interview and how to deploy them in your environment.
