Ruby 4.0.9, 3.4.12, and 3.3.13 (October 23, 2026) fix the Onigmo regex bugs behind GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264. Any Ruby app that builds a Regexp from outside input should upgrade. Five Ruby versions built under WSL2 show the unpatched ones crashing on the fix PRs' test patterns.
GitLab's October 21, 2026 critical patch release fixes CVE-2026-110264, a CVSS 10.0 bug in every version since 7.0. How an Org-mode #+TODO: line overflows Onigmo's repeat IDs, which versions to install, why the fix lives in GitLab's bundled Ruby, what to grep in your logs, and a local test showing stock Ruby 4.0.6 is still unpatched.
15 formats renamed to .png, then Rails 8.1.3 vs 8.1.3.1 on one attachment: SVG logged 123x45 on the vulnerable build, nothing on the patched one. Plus the matload entry point and the libvips 8.13 floor that stops boot.
