Penetration Tester: 2026-09-25

1. Send GitLab an email, push to main

   Aikido Security, 2026-09-23. Read, 11 min.

   Aikido reports that the private address behind GitLab's "Email work item to this project" feature embeds a long-lived token tied to the user's account, and that anyone holding it can push code and run CI/CD jobs in every project the account can reach, bypassing IP restrictions in Aikido's test. Aikido found a dozen such addresses published in READMEs, contributing guides, and support pages, and says GitLab closed its HackerOne report as intended behavior, then updated its UI text and documentation while leaving the mechanism untouched.

   Why it matters for this role: Public READMEs and support pages can hand you a GitLab credential disguised as an email address, which belongs in the reconnaissance you do against a client's public footprint.

2. HTTP/3 in Burp Suite - it’s time to find a bigger wordlist

   PortSwigger Research, 2026-09-23. Read, 6 min.

   PortSwigger added HTTP/3 support to Turbo Intruder, including an AUTO engine for Burp Suite Professional users that selects the highest HTTP version available and tunes its settings as an attack runs. A separate HTTP/3 Adapter extension converts Burp Suite's HTTP/1.1 and HTTP/2 traffic to HTTP/3, so testers can now reach sites that only support HTTP/3.

   Why it matters for this role: HTTP/3-only endpoints that sat in scope but out of your proxy's reach are now testable from Burp, which is worth a second pass on recent targets.

3. Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?

   Rapid7, 2026-09-25. Read, 5 min.

   This week's Metasploit release adds five modules, including an auxiliary module for CVE-2026-85706, an unauthenticated arbitrary file read in GitLab CE and EE that Rapid7 describes as exploited in the wild, and native DHCPv6 and IPv6 router advertisement DNS takeover modules for use in a Kerberos authentication relay chain. It also adds an authenticated remote code execution exploit for Langflow 1.11.1 and below (CVE-2026-18729).

   Why it matters for this role: Self-hosted GitLab in the affected ranges is now a finding you can confirm on an authorized engagement with a stock Metasploit module.

Penetration Tester