GitLab has patched a critical security flaw with a CVSS score of 10.0, the highest possible severity. The vulnerability, CVE-2026-110264, could allow an unauthenticated attacker to execute arbitrary code on self-managed GitLab servers. It affects GitLab versions dating back to 7.0, released in 2014. GitLab says there is currently no evidence that the flaw has been exploited, but recommends updating to a patched version as soon as possible.

GitLab Q2, and why it blew out the quarter: - Four months ago this was the consensus AI casualty in B2B. Stock in the high teens. They cut 14% of the company in May, exited 22 countries, took out three layers of management. - This week: revenue $286.3M, +21%, five points ahead of their own guide. Record gross bookings. Stock up ~15-20%. Four things actually drove it, and none of them are "AI hype": #1#. More AI coding means more GitLab, not less Secure repositories +60% YoY. Code pushes +50%. CI/CD pipelines +40%. Among their most aggressive AI adopters, codebases have grown as much as 500%. Agents write the code. Somebody still has to store it, scan it, review it, and ship it. #2#. They repriced GitLab Flex replaced fixed seat quantities with one dollar commitment that draws down across seats, credits, and usage, re-elected monthly. $20M+ committed from 130+ customers in six weeks. Paid consumption run rate went $15M to $40M+ in one quarter, targeting $100M by year end. #3#. The enterprise leaned in Deals over $500K up more than 150%. First orders ~1,700, more than double. 8 of their 10 largest deals bought Ultimate. #4#. Sales capacity +30% and productivity per rep +10% ... in the same year they cut 14% of the company. -> The bill: gross margin 90% to 86%, because they buy inference. -> And Flex pushes revenue later, so Q3 revenue is guided *below* Q2 despite record bookings. They took a worse revenue line this year to get a better business next year. That is the whole quarter.

GITLAB $GTLB Q2’27 EARNINGS HIGHLIGHTS 🔹 Revenue: $286.3M (Est. $273M) 🟢; +21% YoY 🔹 Adj. EPS: $0.24 (Est. $0.18) 🟢; flat YoY 🔹 Non-GAAP Oper Income: $42.6M (Est. $31.2M) 🟢 🔹 Dollar-Based Net Retention Rate: 117% FY27 Guide: 🔹 Revenue: $1.129B-$1.133B (Est. $1.12B) 🟢 🔹 Non-GAAP Oper income: $148M-$152M (Est. $138M) 🟢 🔹 Adj. EPS: $0.85-$0.87 Q3 Guide: 🔹 Revenue: $281M-$283M (Est. $281M) 🟡 🔹 Non-GAAP Oper income: $35M-$37M (Est. $29.6M) 🟢 🔹 Adj. EPS: $0.19-$0.20 Segment Net Revenue: 🔹 Subscription: $258.3M 🔹 License: $27.9M Other Q2 Metrics: 🔹 Non-GAAP Gross Margin: 86% 🔹 Adjusted Free Cash Flow: $9.8M 🔹 Total RPO: $1.2B; +16% YoY 🔹 cRPO: $744.7M; +20% YoY 🔹 Customers >$100K ARR: 1,571; +17% YoY Business Highlights: 🔹 Launched: GitLab Secrets Manager 🔹 Introduced: GitLab Flex commercial model Comments: 🔸 “record gross bookings and net ARR growth exceeding 40% year over year” 🔸 “sequential acceleration in dollar-based net retention and meaningful operating leverage”

GitLab has apparently taken down the Nightmare-Eclipse account just days after the researcher moved there following the GitHub ban. The drama started after Nightmare-Eclipse released several Windows exploits and Defender bypass tools, including BlueHammer, RedSun, and UnDefend. GitHub removed the account earlier this week over concerns that the tools could be misused and weaponized. Security company Huntress says some of the tools have already been seen in real-world intrusion cases, showing how quickly proof-of-concept research can end up being used in actual attacks.

ChatGPT can now inspect @gitlab merge requests and help investigate failed CI jobs. Install it from the plugin directory. In beta right now. Setup guide:

I am a Senior Engineering Manager at GitLab. Was. I believed in CREDIT. Collaboration. Results. Efficiency. Diversity, Inclusion & Belonging. Iteration. Transparency. I had the mug. The mug was from 2019. It was orange. It sat on my desk for six years. Every all-hands, someone would reference CREDIT. Every performance review cycled through the letters like a rosary. Every new hire got a laminated card in their welcome packet explaining what each letter meant and why it mattered. I was a CREDIT Champion. Quarterly nomination. Q3 2022. The certificate is a PDF. The PDF is in a Google Drive folder. The folder is in a workspace that no longer exists. Last week, GitLab released the "Act 2" memo. Act 2 eliminates CREDIT. Act 2 also eliminates people. Same memo. Same paragraph. Same bullet point. The restructuring and the value deletion share a semicolon. They didn't kill the values and then, separately, lay people off. They didn't lay people off and then, quietly, retire the values framework. They did both in one sentence. One announcement. One act. Act 2. Here is what CREDIT meant when I believed in it: the company had principles that existed independently of headcount decisions. The values were the thing that stayed constant when everything else changed. That's what I told my team. That's what I told candidates in interviews. That's what the laminated card said. Here is what CREDIT meant when they killed it: the values were a feature of the company at a particular size. When the size changed, the values became legacy architecture. Deprecated. End-of-lifed. Like a product nobody uses anymore. I used it. The #values-in-action# Slack channel had 4,200 members. People posted examples of colleagues demonstrating CREDIT behaviors. Recognition. Gratitude. Iteration stories. The channel was archived in May 2026. No announcement. Just archived. The way you archive something you don't want people to find. But here is the thing I keep coming back to. They could have killed CREDIT quietly. A blog post three months later. A rebrand. "We're evolving our framework." Companies do this. It's normal. Expected, even. They chose to put it in the layoff memo. They chose to tell the people they were firing that the values those people believed in were also being fired. In the same breath. As if the values and the people were the same line item. As if eliminating one was inseparable from eliminating the other. And maybe it was. Maybe the values only existed to describe the workforce they needed at that size. Collaboration — because they had too many people for silos. Iteration — because they couldn't afford to get it right the first time with that headcount. Transparency — because with 2,000 remote workers, opacity was operationally expensive. Remove the people, and the values that described their labor become vestigial. Unnecessary. Legacy. The mug is still on my desk. The values are not. The job is not. But the mug is.

Projects can span repositories from GitHub, GitLab, and other Git providers, and findings reach your tools through a new API and MCP connector. Eligible orgs receive $25K in usage credits each month, for two months, through Dec 31, 2026. Terms apply: