https://pwn.watch/t/crimson-collective Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 10 Oct 2025 00:00:00 GMT https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025 https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025 Fri, 10 Oct 2025 00:00:00 GMT high <p>The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2025-10-10: FINRA alert to member firms (<a href="https://www.finra.org/rules-guidance/guidance/red-hat-security-incident-20251010">source</a>)</li><li>2025-10-02: Red Hat confirms the incident (<a href="https://www.redhat.com/en/blog/security-update-incident-related-red-hat-consulting-gitlab-instance">source</a>)</li><li>2025-10-01: Crimson Collective claims the Red Hat GitLab theft (<a href="https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/">source</a>)</li></ul>