This Week in Tech: GitLab and Drupal Exploits, Supply Chain Scares, AI Launches

This roundup covers the stories from the past week that matter most to admins and home-lab builders. First come the security items you may need to act on. Then come the trending topics worth knowing about. Everything here is as of October 30, 2026, and details may change as the stories develop.

Security

GitLab: a maximum-severity flaw is now exploited

CISA says attackers have started exploiting a maximum-severity GitLab vulnerability that was patched earlier this month, according to BleepingComputer. If you run a self-managed GitLab instance, whether at work or in the lab, this is the item to check first.

A few things to do today:

• Confirm which version your instance runs and compare it with the fixed version in GitLab's advisory.
• If you are behind on patches, update before you do anything else.
• Review whether the instance is exposed to the internet. A home-lab GitLab does not need to be reachable from everywhere.
• Look through audit and access logs for unfamiliar activity since the patch release date.

Drupal Commerce Core: critical access bypass

Drupal has warned administrators about a critical access bypass in the Commerce Core module that attackers are exploiting in the wild, as BleepingComputer reports. If you run Drupal Commerce, read the official security advisory and apply the update. If you can't patch right away, check the advisory for any mitigation it describes.

The GitLab and Drupal items share a lesson. A fix that is a few weeks old is still a risk if it has not been deployed. Attackers read advisories too.

Hugging Face models used to hijack GPUs

A crypto-mining campaign that abuses Hugging Face models has returned days after a takedown, according to BleepingComputer. The report says the campaign hijacks GPU servers and plants backdoors, and that one model was downloaded more than 28,000 times.

This matters for anyone running local AI in a home lab. Downloading a model is closer to installing software than downloading a document. Some practical habits:

• Prefer well-known publishers and check who uploaded a model.
• Run unfamiliar models in an isolated VM or container, not on a host that holds credentials.
• Watch GPU utilization and outbound connections for anything you did not start.
• Avoid loading model formats that can execute code unless you trust the source.

Third-party scripts and suppliers keep causing breaches

Several of this week's incidents involved a vendor or a script the victim did not write:

• Polymarket paused trading after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with about $2.5 million traced so far, per BleepingComputer.
• Japan Airlines said a breach at Amadeus's Passenger Service System exposed data on about 92,000 customers, per BleepingComputer.
• A UK reseller of Shelly products warned that payment data was stolen after malware was found on its website, according to The Register.

Binance is also investigating a potential breach involving up to $5.8 billion in digital assets, which BleepingComputer says could become the largest cryptocurrency hack in history. That investigation is early, so treat the figures as unconfirmed.

For your own environment, the takeaway is to inventory what you load from outside. That includes JavaScript on your web properties, vendor integrations, and the services that hold your customers' data. Consider content security policy and subresource integrity for scripts you must include.

Trending

New AI models

Google announced Gemini 4 Carbon, which Ars Technica describes as a frontier model that you can't use yet and as "essentially a slightly better version of Argon" (Ars Technica). Separately, a Reuters report shared on Hacker News says Mistral's CEO claims Mistral 4 beats Chinese open-weight models in some areas (Reuters). Vendor claims about benchmarks deserve testing on your own workloads before you change anything.

Intel takes a hit

The Register's headline says a PC chip plunge wiped out a quarter of Intel's value, and that the CEO predicts a datacenter CPU boom although production problems may keep the company from cashing in (The Register). If you are planning hardware purchases, it is a reminder to watch both pricing and supply.

Linux distributions and benchmarks

Phoronix ran a comparison of CachyOS, Fedora 45 and Ubuntu 26.10 on an AMD Ryzen 9, noting that Ubuntu 26.10 was recently released and Fedora Workstation 45 is nearly out (Phoronix). Read the full review for methodology and results before drawing conclusions.

Raspberry Pi hints

Patches in the Linux kernel suggest a Raspberry Pi Zero 3 W and a Raspberry Pi 4 Model A may be on the way, per Phoronix. Kernel patches are not an announcement, so specs and availability are still unknown.

A short checklist for the weekend

1. Check your GitLab version and patch it if needed.
2. If you run Drupal Commerce, apply the Commerce Core fix.
3. List the third-party scripts and vendors your sites and services depend on.
4. Move any local AI model testing into an isolated environment.
5. Rotate credentials for any service named in a breach you use.

Wrap-up

The pattern this week is familiar. Known flaws get exploited after patches ship, and attackers go through suppliers, scripts and downloaded artifacts instead of the front door. The best next step is cheap: confirm what you run, what version it is, and where it came from. Next week we will see which of these stories grew.