Threat Digest — Oct. 12, 2026: GitLab RCE & AvisLoader

Top Stories#

AvisLoader uses resilient command-and-control techniques

Varonis researchers analyzed AvisLoader, a Windows malware loader designed to make disruption more difficult through encrypted peer-to-peer communications. The malware combines several behaviors that complicate detection and removal:

• ClickFix-style social engineering for initial delivery
• Shortcut-based persistence
• Remote command execution
• Encrypted peer-to-peer command-and-control traffic

The analysis is reported by BleepingComputer.

Blocking a small set of conventional command-and-control domains may not be sufficient. Detection should combine endpoint execution telemetry, shortcut-file creation, persistence changes, unusual peer-to-peer traffic, and suspicious PowerShell or script activity.

Ahold Delhaize takes systems offline after cyberattack

Retail company Ahold Delhaize confirmed that it took some systems offline in response to a cybersecurity incident affecting its network, according to BleepingComputer.

The available reporting does not establish the incident’s full scope, initial access vector, affected brands, or operational impact. Organizations should avoid treating the event as a confirmed ransomware incident until more evidence is available.

The operational issue is clear: offline decisions can affect stores, distribution, corporate services, and third-party integrations. Retail and other distributed businesses should validate isolation procedures, offline backups, alternate communications, and manual operating processes before an incident requires them.

GitLab warns of maximum-severity CI/CD RCE flaw

GitLab urged customers to immediately patch a maximum-severity vulnerability in its CI/CD Regular Expression Compiler. The issue could allow remote attackers to execute arbitrary code on targeted instances, according to BleepingComputer.

Prioritize GitLab instances that:

• Are reachable from the internet
• Host sensitive source code or deployment credentials
• Use shared or highly privileged runners
• Process untrusted contributions or merge requests
• Have broad access to production environments

After patching, review runner activity, project membership, pipeline changes, deployment-token use, and unexpected code execution. A vulnerable GitLab instance may provide access not only to repositories but also to build environments, secrets, artifacts, and downstream infrastructure. Teams reviewing their CI/CD security controls may also consult this SAST overview.

IonQ agrees to acquire Elisity

IonQ announced an agreement to acquire cybersecurity company Elisity in a deal valued at up to $1.3 billion, as reported through Google News.

The transaction reflects continued investment in cybersecurity and emerging technology. Organizations evaluating security acquisitions should focus on practical integration questions: product overlap, data handling, identity integration, telemetry ownership, support continuity, and how acquired technology will fit existing network-access and segmentation controls.

AI-enabled abuse creates operational disruption

Reporting reviewed by Google News describes malicious and disruptive uses of AI systems, including attacks against companies and fabricated crime reports.

Security teams should treat AI-enabled abuse as both a cyber and business-continuity concern. Fake reports can trigger emergency responses, consume analyst time, damage reputations, and distract personnel during an active incident. Establish trusted escalation channels and require independent verification before acting on high-impact external reports.

Critical Vulnerabilities#

CVE-2026-108804: obsolete TRENDnet routers affected by remotely exploitable command injection

CVSS: 10.0

TRENDnet TEW-751DR, TEW-752DRU, and TEW733GR routers contain an OS command-injection vulnerability in the web management backend. The affected products reached end of life in 2011, and public exploit code is available through a GitHub repository. Additional details are listed by VulDB.

The priority is replacement or removal, not merely configuration hardening. If replacement is not immediate:

1. Remove the management interface from the internet.
2. Restrict administrative access to a controlled management network.
3. Isolate the device from sensitive internal systems.
4. Review logs for unexpected administrative requests and command execution.
5. Plan accelerated retirement because the hardware is obsolete.

CVE-2026-66086: modem OTA stack buffer overflow

CVSS: 9.8

A stack-based buffer overflow in a modem over-the-air update stack may allow remote code execution or denial of service through improperly validated scheduling information in SIB1 messages.

The vulnerability affects modem and cellular-device supply chains, so remediation may depend on device manufacturers, firmware providers, or service providers. Review the Unisoc product security bulletin, identify affected chipsets and devices, and track firmware availability.

CVE-2026-93582: OTRS authentication through attacker-controlled headers

CVSS: 9.4

OTRS Community Edition 6 and earlier can trust an attacker-controlled Remote-User request header as an authenticated username in certain CGI and mod_perl deployments. This can enable unauthenticated account impersonation.

Apply the fixes described in the OTRS security advisory, verify web-server header handling, and review authentication logs for unexpected user identities or access from unusual sources.

CVE-2026-108860: BotSharp hard-coded JWT signing key

CVSS: 9.1

BotSharp through version 5.2.0 contains a hard-coded JWT signing key. An unauthenticated remote attacker could forge bearer tokens and impersonate users, including administrators.

Review the BotSharp project and the VulnCheck advisory. Treat the signing key as compromised:

• Upgrade or remove affected versions.
• Replace the JWT signing secret with a unique, protected value.
• Invalidate all existing tokens.
• Rotate credentials accessible through the application.
• Investigate administrator logins and token use before remediation.

For human-managed credentials associated with the application, an approved password manager such as Try 1Password → can help reduce reuse and unsafe storage.

CVE-2026-78357: OTRS tokens may survive account changes

CVSS: 9.1

Previously issued OTRS authentication tokens may remain valid for approximately 16 hours after an account is deactivated or its password is changed. Anyone holding a valid token may therefore retain access during that period.

Apply the remediation in the OTRS security advisory. Review active sessions and tokens, force invalidation where supported, and confirm that deactivation and password-reset workflows revoke access promptly.

None of the five listed vulnerabilities is currently marked as added to CISA’s Known Exploited Vulnerabilities catalog in the supplied data. That status should not delay remediation of the TRENDnet router flaw: public exploit code is available, and the products are obsolete.

What Defenders Should Do Today#

1. Patch and validate GitLab

• Identify all GitLab instances, including unmanaged or departmental deployments.
• Confirm the installed version and apply the vendor-provided update.
• Review CI/CD Regular Expression Compiler exposure and use.
• Audit runner permissions and whether runners can reach production systems.
• Search for unexpected projects, pipeline changes, runners, artifacts, and deployment credentials.
• Rotate secrets if unauthorized code execution cannot be ruled out.

2. Remove or isolate obsolete TRENDnet routers

Do not rely solely on internet filtering if replacement is practical. Retire affected routers, preserve relevant logs, and inspect downstream devices for suspicious administrative activity.

3. Address BotSharp token forgery risk

For systems using BotSharp 5.2.0 or earlier, rotate the hard-coded JWT secret, invalidate existing tokens, rotate application credentials, and investigate privileged account activity.

4. Fix OTRS identity and session handling

Apply the relevant OTRS fixes, reject untrusted Remote-User headers at the web-server boundary, revoke active sessions after password changes or deactivation, and review authentication records for impersonation indicators.

5. Coordinate modem remediation

Inventory cellular and embedded devices using affected modem components. Work with manufacturers and service providers to obtain firmware updates, document devices that cannot be updated, and apply compensating controls where feasible.

6. Hunt for AvisLoader behavior

Look for:

• ClickFix-related browser and script execution chains
• Unexpected .lnk or shortcut-file creation
• New or modified startup and persistence mechanisms
• Suspicious child processes from browsers or office applications
• Encrypted peer-to-peer connections that do not match approved applications
• Remote command execution from unusual endpoints
• Windows hosts making unexpected outbound connections

7. Test disruption and recovery procedures

Validate offline backups, restoration procedures, network isolation, alternate communications, and manual operating processes. Confirm that critical business functions can continue if selected systems must be taken offline.

8. Brief executives and finance leaders

Provide a concise status update covering:

• Affected assets and business owners
• Patch and isolation progress
• Potential exposure of credentials or production systems
• Business continuity decisions
• Customer, regulatory, or contractual considerations
• Risks from AI-assisted abuse and fabricated emergency reports

Technical Notes#

Initial GitLab inventory

Use organization-specific asset-management data first. The following commands can help locate common GitLab references in configuration repositories and infrastructure inventories:

# Search configuration repositories for GitLab endpoints
grep -RInE 'gitlab([.-]|/)|gitlab_url|CI_SERVER_URL' \
  ./infrastructure ./config ./terraform 2>/dev/null

# Find locally configured GitLab runners
find /etc /opt /srv -type f \
  \( -iname 'config.toml' -o -iname '*gitlab*' \) \
  2>/dev/null

After identifying instances, record version, exposure, runner privileges, repository sensitivity, and access to deployment credentials. Do not paste tokens or secrets into tickets or chat systems.

Endpoint triage for shortcut-based persistence

The following searches are examples, not complete AvisLoader detection rules. Adapt them to your EDR and Windows logging architecture:

# Recently modified shortcut files in common user-controlled locations
Get-ChildItem -Path $env:USERPROFILE, "$env:ProgramData" `
  -Filter *.lnk -File -Recurse -ErrorAction SilentlyContinue |
  Sort-Object LastWriteTime -Descending |
  Select-Object -First 100 FullName, LastWriteTime

# Review common startup locations
Get-ChildItem `
  "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
  "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" `
  -Force -ErrorAction SilentlyContinue

Correlate file creation with browser activity, script interpreters, unusual parent-child process relationships, and outbound connections. A suspicious shortcut alone is not proof of AvisLoader infection.

JWT secret rotation workflow

For a BotSharp deployment, use the application’s supported secret-management and token-revocation mechanisms. The high-level sequence should be:

1. Restrict administrative access to the application.
2. Deploy a new cryptographically random JWT signing secret.
3. Restart or reload services using the secret.
4. Revoke all previously issued access and refresh tokens.
5. Rotate dependent credentials and API keys.
6. Review authentication and administrator activity.
7. Confirm that old tokens fail validation.

Avoid placing the replacement secret directly in source code, container images, shell history, or publicly readable configuration files.

OTRS header and token review

At the reverse proxy or web-server boundary, ensure authentication headers cannot be supplied by an unauthenticated client. The exact configuration depends on the deployment, so test changes in a staging environment and confirm the application receives only trusted identity information.

Review logs for patterns such as:

Remote-User: administrator
Remote-User: root
authenticated username differs from source identity
successful login followed by unusual administrative activity
token use after account deactivation or password reset

These patterns are investigation leads, not standalone indicators of compromise.

Router and network telemetry

For affected legacy routers, preserve available logs before replacement when doing so will not prolong exposure. Search perimeter and internal telemetry for:

unexpected requests to router management interfaces
administrative access from unapproved source addresses
POST requests containing shell metacharacters
new outbound connections from router management IPs
configuration changes outside approved maintenance windows

Because obsolete devices may provide limited logging, inspect upstream firewall, DNS, DHCP, VPN, and network-flow data as well. Organizations reviewing monitoring platforms can compare open-source SIEM alternatives when existing telemetry coverage is insufficient.

Sources

• BleepingComputer: Inside AvisLoader
• BleepingComputer: Ahold Delhaize cyberattack
• BleepingComputer: GitLab CI/CD Regular Expression Compiler vulnerability
• TRENDnet exploit references
• Unisoc product security bulletin
• OTRS Security Advisory 2026-18
• OTRS Security Advisory 2026-14
• BotSharp repository
• VulnCheck BotSharp advisory

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.