GitLab RCE via Malicious Jupyter Notebooks — Public PoC Drops for a Quietly Patched Chain
The issue: A working proof-of-concept for remote code execution on self-managed GitLab instances is now public. An authenticated user (no admin rights, no CI runner access, no victim interaction required) can push specially crafted Jupyter Notebook (.ipynb) files, then simply view the commit diff. This triggers a chain of two long-standing memory-corruption bugs in the Oj JSON parser used by GitLab’s notebook diff renderer. One leaks a heap pointer (defeating ASLR); the other overwrites a callback to point at system(). Commands execute as the git user, giving access to source code, Rails secrets, credentials, and CI/CD data.
The flaw was patched by GitLab on June 10 under ordinary bug fixes (no CVE assigned at the time). Affected versions include 15.2–18.10.7, 18.11.0–18.11.4, and 19.0.0–19.0.1. GitLab.com and Dedicated are already protected; self-managed admins must upgrade immediately to the fixed releases (18.10.8 / 18.11.5 / 19.0.2 or later). Older unsupported branches have no backport.
Why it matters today: Once a public PoC appears, mass scanning and opportunistic exploitation typically follow within hours. Source-code repositories remain high-value targets for both ransomware groups and nation-state actors. Any organization running self-managed GitLab should treat this as an emergency patch window and audit for unexpected notebook commits or anomalous git-user activity.
TELESHIM Campaign: East Asia-Linked Actors Abuse Telegram for Stealthy C2 Against Middle East Governments
The issue: Zscaler ThreatLabz has detailed a multi-stage intrusion set targeting government entities in the Middle East. The chain starts with weaponized ISO/IMG files containing a legitimate ASUS executable that sideloads a malicious DLL, delivering the previously undocumented TELESHIM backdoor. TELESHIM uses the official Telegram Bot API for command-and-control—polling getUpdates, decrypting instructions, executing them via cmd.exe, and returning results—while blending into ordinary HTTPS traffic to a trusted service. Follow-on stages deploy MIXEDKEY (reflective loader with environmental keying) and the BINDCLOAK implant.
Operators conducted hands-on-keyboard reconnaissance (net user, ipconfig, etc.) and established persistence via scheduled tasks. Activity was observed earlier this month, with the public technical write-up circulating strongly in the last 24 hours.
Why it matters today: Living-off-the-land C2 via popular messaging platforms continues to frustrate network-based detection. Government and critical-infrastructure networks that allow Telegram traffic (or fail to inspect it) remain exposed. Defenders should hunt for unexpected Telegram API calls from endpoints that have no business need for them, monitor for the specific staging directories and MAC-address-based validation patterns described in the research, and review ISO/IMG handling policies.
Claude Shared Chats Indexed by Google — Sensitive Conversations Suddenly Searchable
The issue: Anthropic’s Claude “share” feature generates public URLs for conversations. Because those pages lacked effective noindex directives, search engines (most visibly Google) crawled and indexed hundreds of them. Users searching site:claude.ai/share could locate chats containing API keys, crypto wallet details, resumes with PII, legal strategy notes, proprietary code, internal documents, and other sensitive material without ever receiving a direct link from the original sharer.
The problem surfaced over the weekend via Reddit and X threads; by July 27 many of the results had been de-indexed after the issue gained attention. Anthropic has not issued a detailed public statement, but the rapid disappearance of results suggests backend changes or de-indexing requests. Similar incidents previously affected ChatGPT shared links.
Why it matters today: “Share with anyone who has the link” is not the same as “not publicly discoverable.” Users who shared chats containing credentials, personal data, or confidential work product should immediately go to Settings → Privacy → Your Data → Shared Chats, review, and delete anything sensitive. Organizations should remind employees that AI chat transcripts can become persistent public artifacts and should never contain secrets. The episode is a timely reminder that convenience features in AI tools still require the same rigorous privacy engineering applied to traditional web applications.
Bottom line for defenders today: Patch self-managed GitLab instances now, hunt for Telegram-based C2 and unexpected notebook activity, and scrub any Claude (or similar) shared chats that may contain sensitive material. The common thread across these three stories is the shrinking gap between disclosure/public PoC and real-world impact—whether through quiet memory-corruption chains, living-off-the-land messaging platforms, or overlooked indexing of AI collaboration features.
Stay sharp.