Top 5 Cybersecurity Events of the Week: Linux, Telegram and GitLab Bugs

Jet CSIRT has released its weekly digest covering the top five information security events. The latest overview highlights critical vulnerabilities found in enterprise software, networking hardware, and popular messaging applications. Security experts urge administrators and regular users to apply necessary patches promptly.

• Weekly overview of key cybersecurity incidents by Jet CSIRT.
• Critical vulnerability CVE-2026-110720 in HashiCorp Consul-k8s and a zero-click flaw in the Linux TCP stack.
• GitLab exploitation attempt, Intelbras camera DoS vulnerabilities, and a remote code execution bug in Telegram for Android.

Vulnerabilities in HashiCorp Consul and the Linux TCP Stack

Security specialists at HashiCorp reported a critical vulnerability, tracked as CVE-2026-110720 with a CVSS score of 9.9, affecting Consul-k8s, a service mesh product used in Kubernetes. The flaw allows attackers to bypass authorization rules between namespaces within ACL binding configurations, enabling privilege escalation and unauthorized service control. Fixes are available in versions 2.1.0 and 1.8.18, and administrators are advised to update immediately.

Meanwhile, Anthropic's Claude AI model discovered a zero-click vulnerability, CVE-2026-98432, within the Linux kernel TCP stack. The bug stems from a synchronization failure during incoming IPv4 TCP connection processing, leading to a use-after-free condition. An unauthenticated attacker could execute code with root privileges on servers with Multipath TCP enabled. The patch has been added to the main kernel branch, though major distributions like Ubuntu and RHEL are still preparing their updates.

GitLab, Intelbras Cameras, and the Telegram Flaw

An unidentified threat actor attempted to exploit critical vulnerability CVE-2026-97229 (CVSS: 10.0) in an Alpine Linux GitLab instance, stemming from a regular expression engine flaw within Ruby. While GitLab released patches in October, they only apply to the bundled Ruby version; instances compiled with custom Ruby builds remain vulnerable until updated manually to versions 3.3.13, 3.4.12, or 4.0.9.

Kaspersky discovered a DoS vulnerability in Intelbras IP cameras whose companion app, Intelbras Mibo Smart, has been downloaded over 4 million times on Google Play. The firmware update endpoint accepts files without authentication, allowing an attacker on the same Wi-Fi network to trap the device in an endless reboot loop. Furthermore, NebuSec disclosed a vulnerability in Telegram for Android versions 8.6.2 through 12.10.3, where malicious voice call signals could trigger arbitrary code execution. Telegram patched this issue in version 12.10.4.

Implications for Security Professionals and Businesses

These security incidents highlight the critical importance of robust patch management and proactive infrastructure monitoring across corporate networks and mobile applications alike. The utilization of artificial intelligence for vulnerability discovery, as seen with the Linux kernel flaw, signals a shifting threat landscape that demands rigorous pre-emptive code auditing. Organizations should swiftly review their Kubernetes deployments, version control systems, and connected hardware to mitigate potential attack vectors.