The IT Nerd

Abstract’s ASTRO research team published a blog last night entitled CVE-2026-85706: Detecting GitLab’s Unauthenticated File Read in Your Logs.

The post digs into news that GitLab patched a critical vulnerability in the repository commits API of its Community and Enterprise Editions. Tracked as CVE-2026-85706 and rated CVSS 10.0, the flaw lets an unauthenticated remote attacker read files from a self-managed GitLab server. The primary issues in the flaw are that the endpoint takes a file path from the request without keeping it inside the intended repository directory, and it does not check whether the caller is authenticated.

The ASTRO team’s post addresses the following topics:

• Affected products
• Patching and Mitigation
• How Exploitation Works
• Where the Evidence Lands
• Detection Guidance
• Abstract Detections

You can read the report here: CVE-2026-85706: Detecting GitLab’s Unauthenticated File Read in Your Logs | Abstract

Abstract’s ASTRO research team just released a new report: Priced to Move: The Underground  Markets of Modern Cyberattacks.

The ASTRO team offers these critical threats for the remainder of 2026:

The ecosystem demonstrated remarkable resilience despite law enforcement successes: BreachForums returned months after its April 2025 takedown, and 57 new ransomware groups emerged to fill gaps left by disrupted operations. Intelligence assessments predict 2026 will mark the first year that non-Russian ransomware actors will outnumber those within Russia. An alarming trend of ransomware groups recruiting corporate insiders further blurs the line between external and internal threats. 

The Priced to Move: The Underground  Markets of Modern Cyberattacks report goes in-depth into:

• The Broker: Three Weeks of Silence
• What just happened: The IAB Model
• The IAB Marketplace
• Meet the Brokers: A Field Guide
• How They Get In
• Twelve Months Inside One Operation
• The Pipeline in Action
• When the Broker Gets Caught
• Detection and Defense
• Impact and Trends
• Law Enforcement and Policy

You can read the report here: https://www.abstract.security/reports/priced-to-move

Abstract, the leader in streaming-first security operations, today announced it joined the expanding Torq AMP alliance program, designed to drive agentic AI innovation. Abstract was chosen due to its platform featuring a security data pipeline with streaming-first detections built in that seamlessly integrates with Torq’s AI SOC platform to empower customers and their SOC/Incident Response teams.

Torq AMP is unlike any other partner program in the history of cybersecurity. It exists in stark contrast to partner programs stuck in the distant past, built on elitist tiering systems, pay-to-play participation, and excessive bureaucracy. With Torq AMP, partners such as Abstract easily leverage Torq’s AI SOC platform and agentic AI capabilities to create unique, high-value solutions that integrate across mutual customers’ security stacks and ISV ecosystems. Torq AMP delivers builder-focused — not engineering-focused — integrations that elevate the value of partner offerings and go far beyond the static, pre-defined integrations of typical tech alliances. It’s all about driving mutual growth, adoption, and buzz for all participants.

Torq AMP provides these exclusive benefits to Abstract:

• Integrated Solution Creation: Build innovative, joint AI-driven SecOps solutions quickly and easily at scale, without heavy engineering efforts
  
• Deep Torq Sales Engagement: Joint field marketing events, collaborative prospecting, and integrated presence in Torq demo environments
  
• Strategic GTM Collaboration: Collaborative sales enablement, team training, channel packaging, ROI analysis, and reporting
  
• Disruptive Marketing Activation: Integration highlighted within the Torq platform, on Torq’s website, in customer and prospect emails, and across social posts, messaging, and custom swag