On 12 October 2026, GitLab shipped 19.4.2, 19.3.5 and 19.2.8 to fix CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler that allows unauthenticated remote code execution. If you self-host GitLab, upgrade now and treat your .gitlab-ci.yml files as code, not configuration.
Docker Hub now supports OpenID Connect for GitHub Actions. Workflows authenticate with short-lived, per-run tokens instead of storing PATs or OATs in GitHub secrets. Manual credential rotation is officially obsolete.
JetBrains disclosed CVE-2026-63077 on July 27, 2026 — a CVSS 9.8 unauthenticated remote code execution flaw affecting every on-premises TeamCity instance. No active exploitation has been detected yet, but the clock is ticking: TeamCity's history with state-sponsored attackers makes this a drop-everything patch scenario.
Custom runner images hit general availability on March 26, 2026 after a six-month public preview. They eliminate per-job setup and speed up pipelines — but shift image maintenance, security patching, and versioning squarely onto your team.
Jenkins 2.541.2, released February 18, 2026, patches a stored XSS and an information disclosure flaw while the 2.541 line hardens the core with native Content Security Policy. The CI/CD dinosaur isn’t going extinct — it’s becoming the mainframe nobody can afford to migrate.
GitLab 19.0 shipped on May 21, 2026 with a native Secrets Manager, AI-driven merge requests, and an SBOM scanner. The platform closes the gap between writing code and shipping it securely — a gap GitHub Copilot still leaves open.
