Today’s digest is dominated by patch-now items rather than follow-ups: an out-of-cycle GitLab release, a 600,000-site WordPress plugin fix, and a mobile chipset flaw with no fix at all sit alongside a retail breach that traces back to a logistics vendor rather than the retailer itself. Here’s what’s new since yesterday’s digest.
Vulnerability watch: GitLab rushes out an emergency patch for an unauthenticated GraphQL flaw that could delete public projects
GitLab shipped 19.2.4, 19.1.6, 19.0.8, and 18.11.11 on August 17 as an ad hoc critical patch release, outside its normal twice-monthly security schedule. The flaw, CVE-2026-19478 (CVSS 9.4), is a code injection bug in a GraphQL directive that, under certain conditions, lets a remote, unauthenticated attacker alter or delete public projects and user data — no login, no API token, no prior access required. Affected versions span CE/EE 18.2 through 19.2.3. GitLab Dedicated customers are already on the patched build and don’t need to act; self-managed instances, especially anything with a public-facing GraphQL endpoint or public repositories, are the exposure. The Hacker News · GitLab patch notes
If you run self-managed GitLab, this is a today item, not a next-maintenance-window item — an unauthenticated attacker deleting public projects is as close to worst-case as a GraphQL bug gets. Confirm your instance is on 18.11.11, 19.0.8, 19.1.6, or 19.2.4 and check whether your GraphQL endpoint is reachable from the open internet at all; if it doesn’t need to be, that’s worth closing off regardless of patch status.
WordPress watch: A chained upload flaw in the Forminator plugin gives unauthenticated attackers a webshell on 600,000+ sites
CVE-2026-15748 (CVSS 9.8) affects Forminator Forms, a drag-and-drop form builder plugin active on more than 600,000 WordPress sites. The vulnerability isn’t a single bug but a chain of weaknesses in the plugin’s file-upload path: on any form that combines a File Upload field with a Select field, an unauthenticated visitor can upload an executable PHP file with no login, no account, and no user interaction beyond submitting the form. A successful upload plants a webshell and hands the attacker the whole site. The fix is Forminator 1.56.2. The Hacker News · SecurityOnline
The exploitation bar here is unusually low — CVSS 9.8 on a plugin this widely deployed means opportunistic scanning starts within days, not weeks. If you run Forminator, update to 1.56.2 now, and while you’re in there, audit any forms that pair a File Upload field with a Select field for evidence of tampering, since that specific combination is the trigger condition.
Incident watch: Pokémon Center notifies UK and German customers after a breach at its shipping vendor, CEVA Logistics
Pokémon Center has begun emailing customers in the UK and Germany to disclose that their personal information was exposed — not through its own website, but through CEVA Logistics, the third-party shipping vendor it uses to fulfill orders in those markets. The breach notification followed an earlier cover story: affected customers had already been told their orders were canceled due to an “unforeseen fulfilment issue” before Pokémon Center explained the real cause. Exposed data includes customers’ full names, mailing addresses, phone numbers, and email addresses. The underlying CEVA Logistics intrusion is believed to have started around July 29–30 and disrupted at least eight warehouses across Europe, with the Dutch Data Protection Authority reporting breach notifications from ten separate organizations tied to the incident — Pokémon Center is one of several retailers caught in the same third-party blast radius. BleepingComputer · TechCrunch
Nothing about this breach involved a flaw in Pokémon Center’s own systems, which is exactly the point — a single compromised logistics or fulfillment vendor can expose customer PII for every retailer that shares order data with it. If any of your vendors handle customer names, addresses, or contact details for fulfillment, this is a reasonable prompt to confirm what data you’re sending them, whether it’s minimized to what’s operationally necessary, and whether your incident-notification plan covers a breach that starts on their side of the relationship.
Mobile watch: An unpatched Unisoc modem flaw gives attackers full Android kernel access through a single video call
Researchers at SSD Secure Disclosure published a second-stage exploit chain on August 17 that achieves full Android kernel access on devices running Unisoc modem firmware, triggered by a VoLTE video call. The chain builds on a March 2026 disclosure of remote code execution via a malformed SIP video call in the same firmware; this stage exploits the lack of isolation between modem memory and kernel memory, disabling protections on a Memory Protection Unit region to gain unrestricted physical memory access and ultimately modify kernel code. The flaw affects Unisoc T612, T616, T606, and T7250 chipsets, common in entry-level phones — researchers demonstrated it on a Realme C33 and confirmed it on a fully patched Xiaomi Redmi A5 and Motorola E13. Completing the attack requires the attacker to control a private 4G network and the victim to answer the incoming call. SSD says it has been unable to get any response from Unisoc through email or LinkedIn outreach, so there is currently no fix. The Hacker News · SSD Secure Disclosure
The private-4G-network requirement keeps this out of reach of opportunistic attackers for now, but it’s squarely in reach of anyone who can stand up rogue cellular infrastructure near a target — a well-understood capability for state-aligned actors. With no vendor patch available, the only practical mitigation is awareness: if your organization issues or supports entry-level Android devices built on Unisoc chipsets, treat unexpected video calls from unknown numbers as a real attack surface, not just a nuisance, until a fix ships.
Final thought
Three of today’s four items share a theme: the fix, when one exists, landed in an emergency release rather than a routine one — GitLab’s out-of-cycle patch and Forminator’s CVSS 9.8 update both jumped the normal schedule because the exposure was too severe to wait. The Unisoc item is the reminder of what happens when that urgency isn’t met with a vendor response at all. The Pokémon Center breach rounds it out from a different angle — no vulnerability to patch, just a reminder that your data’s exposure often depends on a vendor’s security posture as much as your own. If you want help mapping which of your data flows to third parties and where your incident-notification plan needs updating, see our how-to guides or book a discovery call.