GitLab released critical security patches (19.4.1, 19.3.3, 19.2.7) on September 23, 2026 to address multiple high-severity vulnerabilities including a double-free in the regex parser (CVE-2026-89078) and integer overflow (CVE-2026-93577) that could allow authenticated users to execute arbitrary code via malicious CI/CD configurations. Additional vulnerabilities in the merge request diff viewer and Duo AI feature were also patched.