GitLab Flaw Under Active Attack, Banks Race To Patch

GitLab shipped patches for a set of vulnerabilities that HKCERT's September 14 bulletin described as carrying remote code execution risk, sensitive information disclosure, and cross-site scripting. CISA's warning that hackers are now exploiting the maximum-severity flaw in the wild landed on the same week. GitLab's own advisory language called the issue critical. CISA's confirmed-exploitation notice is the harder claim, and it is the one that determines whether a bank's patch cycle counts as done or as too slow.

The mechanism is unglamorous: GitLab instances are development infrastructure, which means a working exploit does not just compromise a server, it compromises whatever that server had permission to push, merge, or deploy. Source code repositories, CI/CD pipeline credentials, and secrets stored in pipeline variables sit behind that same authentication layer. The engineers who feel this first are the ones running self-managed GitLab instances rather than GitLab.com's SaaS tier, since SaaS patching is GitLab's problem and self-managed patching is theirs, on their own clock, against a vulnerability CISA says is already being used.

GitLab is the named vendor and the named artifact is the September 14 HKCERT bulletin plus the CISA Known Exploited Vulnerabilities addition, not a CVE number either source published. No hardening measure substitutes for patching a self-managed instance now that active exploitation is confirmed; the SaaS tier's advantage this week is that GitLab, not the customer, is the one on the clock.

So the new iPhone dropped, and while everyone was queuing outside the Causeway Bay store, more than 700 people found out their credit cards had already bought one. Not stolen phones off a shelf. Fake orders, placed online, using their card numbers, over the weekend. Police are now on it, and banks say they're reversing the dodgy charges. Small comfort if you're the one refreshing your banking app at midnight wondering why there's an iPhone 18 Pro Max heading to an address you've never heard of.

Here's the part that should annoy you more than it probably does. Every year Apple launches a new phone, every year the scramble to be first gets worse, and every year the fraud rides in right behind it. Scammers don't need your physical card. They just need the number, and enough merchants who don't check hard enough before shipping a HK$10,000 phone to a stranger. The bank will sort your refund eventually. Nobody's sorting the fact that this happens like clockwork every September, right on schedule with the launch event.

Look, the fraud itself isn't the regulatory story here. Cheung Kwok-keung's reporting puts the number at almost 700 unauthorised transactions, HK$8,000 to HK$10,000 apiece, all charged through Apple's wallet infrastructure to cards issued by Hong Kong banks. Lawmaker Johnny Ng wants Apple explaining itself. But Apple isn't the regulated entity in this chain (it's the rail, not the bank), and the HKMA's Banking Conduct Department doesn't supervise device wallets. It supervises the card issuers whose authorised institutions have to run the fraud-detection and customer-notification obligations under the Supervisory Policy Manual's TM-E-1 technology risk module, regardless of where the compromise actually originated.

That's the arithmetic that matters for a compliance head reading this Monday: 700 reports in one window is a pattern, not 700 isolated disputes, and under TM-E-1 an authorised institution has to treat a clustered fraud signal as a control failure to investigate and report, not a customer-education exercise. The banks issuing the "check your statement" warnings are the ones who'll need to show the HKMA where the leak sits, whether that's a compromised merchant token, a provisioning weakness in the wallet enrollment flow, or something upstream of both. Separately, the SFC's September 11 order barring Mok Cheuk Ling from the industry for 42 months is a routine licensing action, no read-through here. The next date that matters is whichever bank first has to file a fraud incident disclosure with the HKMA under TM-E-1, and none had as of this writing. Until one does, the obligation sits with the card issuers, not the platform everyone's blaming.

Manchester City went down to ten men in Sunday's derby and Erling Haaland still finished the day rewriting the club's scoring history, dragging City through a rout that should have been a rescue mission. A VAR call so contested it will get replayed on Sky Sports well into next season sent a City player for an early shower, and City won anyway, which is the least Pep Guardiola sentence of the decade and also, apparently, just Tuesday. Arsenal did their part for symmetry two days later, beating Sunderland 2-0 to stay perfect through the opening weeks after Sunderland had the nerve to hold them 2-2 the last time out. Two unbeaten starts, one city, same postcode for the title race nobody else in London or Manchester has been invited to yet.

Here's the number that actually explains why City can shrug off a red card and a contested VAR call before the sponsors even finish their coffee: City's ownership, Abu Dhabi's City Football Group, doesn't run one club, it runs thirteen, from Mumbai City to New York City to Yokohama, a portfolio built specifically so no single Sunday, no single sending-off, no single refereeing controversy ever threatens the asset. Haaland's derby heroics are the product on matchday. The multi-club network is the balance sheet underneath it, and it doesn't care who gets shown red.

China told Washington this weekend that Xi Jinping's September 24 visit to the White House is conditional on the United States not approving a pending Taiwan arms sale, according to the Taipei Times. The Ministry of Foreign Affairs, under Wang Yi since 2013, delivered the warning as the arms package moved through the same congressional notification process that has cleared Taiwan sales under four US administrations without previously being framed as a summit trigger. Beijing did not ask Washington to cancel the sale outright. It asked for delay past September 24, which converts an arms transfer into a scheduling problem the White House controls and China does not.

That distinction matters because a summit is a date on a calendar and an arms sale is a signature on a notification, and only one of those two things is reversible on short notice. Xi's National Security Commission, the body he has run since 2014 and pared to two members last month, has no vote on US export licensing. What it has is a visit it can walk away from, and walking away from a visit costs Beijing nothing it did not already have. If the sale clears before September 24, the summit becomes the casualty, and Washington will have learned that Taiwan procurement, not the visit itself, is what Beijing was always negotiating.

Beijing has told Washington it will cancel Xi Jinping's September 24 White House visit if the United States proceeds with a new Taiwan arms sale, a threat that reads, on the diplomatic track, as leverage over a summit calendar. It is that. But the more useful reading sits with the PBOC's open-market desk, which has spent the weeks since the Bali framework was floated managing yuan liquidity on the assumption that a Xi visit produces a tariff detente worth pricing into year-end guidance. The desk cannot hedge a cancellation the way the State Department can absorb a delayed meeting.

The PBOC's open-market operators do not set the arms-sale calendar, or, more precisely, they do not control the Pentagon's Foreign Military Sales notification clock that Congress reviews on its own fixed timetable, but they do control how much yuan liquidity gets released against the expectation of a September 24 handshake. If the visit is cancelled, that liquidity plan reverts to the tighter posture Premier Li's economic working group was running before the summit was scheduled, the posture built around a tariff resolution that has not arrived on its own terms. The PBOC's open-market desk has until its next scheduled liquidity operation, ahead of the September 24 date itself, to decide whether it is still underwriting a summit that Beijing has now made conditional on a Pentagon notification neither side controls.