Operators still on unpatched GitLab releases remain exposed, with more than 1,000 internet-facing servers yet to be fixed.
Operators who build GitLab on their own Ruby or container images must patch Ruby as well as GitLab to close the hole.
Self-managed administrators on the affected releases need to upgrade, since over 2,700 Community Edition instances are publicly visible.