GitLab's AI gateway flaw rates 9.9, above Citrix's 9.5

Three of the four security items on today's record are not flaws in an application. They are flaws in the thing that decides who gets into one.

Palo Alto Networks has CVE-2026-0257, an authentication bypass rated 7.8 in PAN-OS GlobalProtect and Prisma Access, already being exploited by the Qilin and Settra ransomware groups for stealthy VPN access, with PAN-OS 12.1, 11.2, 11.1 and 10.2 affected (Cyber Security News). Citrix shipped its third emergency NetScaler fix in two weeks, CVE-2026-107406 at CVSS 9.5, which can lead to remote code execution or denial of service on appliances configured as a SAML identity or service provider, and is not yet known to be exploited (BankInfoSecurity).

The newest door scores highest

GitLab's AI Gateway carries CVE-2026-90970, a template engine flaw rated 9.9 that lets an attacker escape the isolation around standard prompts and run arbitrary commands on the service, with fixes issued for self-hosted Duo Agent Platform installations (SecNews).

Put the three numbers in a line and the ordering is the story. The VPN gateway is at 7.8. The SAML identity provider is at 9.5. The AI gateway, the only one of the three whose job description did not exist a few years ago, is at 9.9. All three sit in the same position in a network: at the edge, holding the credentials for what is behind them. The boundary that fails in the GitLab case is the isolation around a prompt, which is the one of the three that was invented most recently.

Nothing on today's record says the GitLab flaw has been exploited. The Palo Alto one has.

The cost of finding them is falling

OrcaRouter released OrcaCyber Zero 1.5, a gated model for authorized vulnerability research with a 1M-token context, priced at $3.00 and $7.50 per million input and output tokens against Claude Mythos Preview's $25 and $125 (MarkTechPost). That is an eighth of the input rate and under a sixteenth of the output rate.

The capability claims are the vendor's own: 100% on Cybench and 95.8% on a 24-task CVE-Bench subset, reported by the lab that is selling the model. Read them as a price signal rather than as a measurement. The price is the part that is not self-reported, and the price says this work is now being sold at volume rates.

What is published about any of it

SemiAnalysis reviewed 857 models released since 2021 by nine leading Chinese AI developers and found a published safety evaluation tied to a specific model for 31 of them, or 3.6%, with just nine available at or before launch and none covering cyber, biological and loss-of-control risks together (The Indian Express).

Set the two items side by side. One lab is selling vulnerability research by the token at an eighth of frontier pricing. Across 857 releases from another nine labs, nine documents were available at or before launch, and not one of them covered cyber risk alongside the other two. The gated access on OrcaCyber Zero 1.5 is a vendor's own control, and the record of what gets evaluated before release suggests how much weight such controls are carrying on their own.

The bill from the last round

AT&T will pay $177 million to settle lawsuits over two customer data breaches disclosed in 2024, after a federal judge granted final approval (Cyber Security News).

That figure is the trailing cost of edge access that failed two years ago, settled this week. Today's record has the same category of failure in three places, one of them a component built for AI agents and rated higher than the other two, and the tooling for finding the next one listed at $3.00 per million input tokens.