Today’s briefing covers active exploitation of a critical GitLab flaw, a ransomware surge targeting Synology NAS devices, hot wallet thefts on outdated BTCPay Server instances, a Microsoft fix for Smart App Control, and Anthropic’s soaring revenue amid massive losses ahead of a potential IPO.
Listen to today’s briefing (podcast)
Key takeaways
Over 1,000 GitLab servers remain unpatched against actively exploited CVE-2026-97229.
Synology warns of C3RB3R ransomware exploiting a December 2024 patched vulnerability on NAS devices.
BTCPay Server urges immediate update to 2.4.7 after hackers drain hot wallets on older versions.
Microsoft restores Smart App Control via KB5127936 preview update after October breakage.
Anthropic revenue grows 12x but posts $23.3B loss as compute costs surge ahead of IPO.
Over 1,000 Internet-exposed GitLab servers remain unpatched against CVE-2026-97229, a maximum-severity flaw actively exploited for remote code execution, according to BleepingComputer. The vulnerability stems from an integer overflow in the CI/CD Regular Expression Compiler, and GitLab released patches for versions 19.4.2, 19.3.5, and 19.2.8 on October 12.
The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-97229 to its Known Exploited Vulnerabilities Catalog on Friday, ordering federal agencies to secure servers by Sunday, as reported by BleepingComputer. Shadowserver revealed over the weekend that it tracks more than 1,000 unpatched GitLab instances, with over 11,300 vulnerable to a related flaw CVE-2026-110264.
Since November 2021, CISA has added six GitLab flaws to its KEV catalog, one used in ransomware attacks. GitLab says its platform has over 70 million registered users and is used by more than 50% of Fortune 100 companies, per BleepingComputer.
Why it matters: Unpatched GitLab servers are immediate targets for remote code execution, risking data breaches and supply chain compromise.
Synology NAS C3RB3R Ransomware Surge Exploits Patched Vulnerability
Synology warned customers to update DiskStation Manager (DSM) immediately due to a surge in C3RB3R ransomware attacks exploiting a vulnerability patched in December 2024, according to Siber Güvenlik Haberleri. The company urged enabling automatic updates and blocking internet access to the management web interface.
The attacks encrypt data and demand ransom via a dark web portal for “C3rb3r Decryptor” costing thousands of dollars. The ransom note adds a .L0CK3D extension and warns against third-party recovery attempts, as reported by Siber Güvenlik Haberleri. Shadowserver tracks over 380,000 internet-exposed Synology NAS devices.
Synology rarely issues such alerts; the last was in August 2019 for eCh0raix ransomware. The C3RB3R ransomware, a namesake of the 2016 Cerber RaaS, has previously targeted Atlassian Confluence and GitLab servers, per Siber Güvenlik Haberleri.
Why it matters: Outdated Synology NAS devices face active ransomware encryption, putting personal backups and critical data at risk.
BTCPay Server Hot Wallet Thefts Prompt Emergency Update to 2.4.7
BTCPay Server maintainers urged users to update to version 2.4.7 after hackers drained hot wallets on instances running version 2.4.1 or earlier, according to Siber Güvenlik Haberleri. The attack vector allowed unauthorized administrator login on versions older than 2.4.2, released August 7.
The critical vulnerability was discovered via Anthropic’s Frontier OSS scanner, prompting an emergency security update on October 29. BTCPay founder Nicolas Dorier confirmed no credible reports of theft on the latest 2.4.7 release, and the project asked VPS providers to take affected instances offline, per Siber Güvenlik Haberleri.
Affected users should update via Server Settings → Maintenance → Update or run ./btcpay-update.sh for Docker installations. Those on 2.4.1 or older are advised to take instances offline immediately and report losses to security@btcpayserver.org and local authorities, as noted by Siber Güvenlik Haberleri.
Why it matters: Self-hosted cryptocurrency payment processors must patch promptly to prevent unauthorized admin access and fund theft.
Microsoft Windows 11 Smart App Control Fix KB5127936 Preview Update
Microsoft resolved an issue that prevented Smart App Control activation after installing the October 2026 KB5127648 security update on Windows 11 24H2 and later, according to BleepingComputer. The feature, which blocks harmful apps using code integrity and app intelligence, was grayed out on affected devices.
The fix is included in the KB5127936 preview update released October 28. Microsoft also provided a temporary registry workaround for enterprise admins who prefer to wait for November’s Patch Tuesday, involving two reg add commands and a restart, as detailed by BleepingComputer. Group Policy settings can also enable Smart App Control and logging.
The same preview update also resolves Remote Desktop failures with Administrator protection enabled and Always On VPN issues from September cumulative updates, per BleepingComputer.
Why it matters: The fix restores a critical security layer that blocks malicious software on Windows 11 devices.
Anthropic Revenue Surges 12x but $23 Billion Loss Highlights AI Compute Costs
Anthropic posted quarterly revenue of nearly $17 billion, twelve times the year-ago figure, but operating costs of $17.5 billion led to a net loss of $23.3 billion, up from $12.1 billion a year earlier, according to The Decoder. The company cited $5 billion for short-term compute capacity and $2 billion in employee donation matching as primary cost drivers.
Anthropic has been grappling with a compute crunch since late last year, signing dozens of deals with Amazon, Google, SpaceX, chipmakers, and former crypto miners. The company expects access to more than 3.5 gigawatts of power this year and plans to double that next year, with $895 billion in commitments for compute and data center leases, per The Decoder.
An IPO could raise around $100 billion, with up to $3.5 billion from Japanese investors, as reported by The Decoder.
Why it matters: The extreme capital intensity of frontier AI development underscores massive infrastructure scaling challenges and sustainability questions.
Synology NAS on Amazon — The story warns of a ransomware surge targeting Synology NAS devices and urges owners to apply updates immediately. See current options and reviews on Amazon. View on Amazon
As an Amazon Associate I earn from qualifying purchases.
These stories highlight the urgent need for timely patching across diverse platforms and the staggering infrastructure investments driving the AI race. Stay updated and secure.
Ali YAZICI is a Senior IT Infrastructure Manager with 15+ years of enterprise experience. While a recognized expert in datacenter architecture, multi-cloud environments, storage, and advanced data protection and Commvault automation , his current focus is on next-generation datacenter technologies, including NVIDIA GPU architecture, high-performance server virtualization, and implementing AI-driven tools. He shares his practical, hands-on experience and combination of his personal field notes and “Expert-Driven AI.” he use AI tools as an assistant to structure drafts, which he then heavily edit, fact-check, and infuse with my own practical experience, original screenshots , and “in-the-trenches” insights that only a human expert can provide.
