147 press releases in English indexed under jobs & workplace.
Irvine, California timeshare exit advocacy firm recognized every year since 2023 for transparency, client advocacy, and workplace culture
Fast, reliable connectivity now underpins streaming, cloud computing, remote work and online learning. That dependence is pushing the global broadband services market toward a major [read full press release...]
Grayhawk Safety & Health Consulting provides OSHA expert witness and workplace accident investigation services for serious incidents and litigation. Led by Randy Gray, with 25 years of OSHA experience, the company offers impartial investigations, technical analysis, and litigation support for both plaintiff and defense counsel. -- When a serious workplace accident occurs, determining what happened, why it happened an
Ad hoc announcement pursuant to Art. 53 LR Basel, 22 October 2026 Roche continues strong momentum in the third quarter with sales growth of +7% at constant exchange rates (CER) and +8% in CHF; Group sales increase +6% (CER), +1% in CHF, in the first nine months of 2026 Group sales were +6% at constant exchange rates (CER)1, +1% when reported in CHF and +7% in USD2, in the first nine months of 2026, driven by high demand for our innovative medicines and diagnostics. In the third quarter, sales grew +7% (CER) and +8% in CHF (+7% in USD), as exchange rates stabilised. Pharmaceuticals Division sales were +7% at CER, +2% when reported in CHF and +8% in USD, in the first nine months, due to continued high demand for medicines to treat severe diseases; Xolair (chronic hives, food allergies), Hemlibra (haemophilia A), Ocrevus (multiple sclerosis), Phesgo (breast cancer) and Vabysmo (severe eye diseases) were the top growth drivers. Diagnostics Division sales were +4% at CER, stable when reported in CHF and +6% in USD, in the first nine months, as demand for core lab and pathology solutions more than offset the impact of healthcare pricing reforms in China. Highlights: US approval for Tecentriq for the adjuvant treatment of stage-III DNA mismatch repair colon cancer, Gazyva/Gazyvaro for reducing the risk of relapse in patients 2 years of age and older with frequently relapsing or steroid-dependent childhood-onset idiopathic nephrotic syndrome and Enspryng in thyroid eye disease US Priority Reviews for fenebrutinib in both relapsing and primary progressive multiple sclerosis and Enspryng in MOGAD, an autoimmune disease; vamikibart filing acceptance in uveitic macular edema, a leading cause of vision loss EU approval for Susvimo in neovascular age-related macular degeneration (nAMD), a severe eye disease, and Ocrevus in paediatric relapsing multiple sclerosis; EMA validation of application for Enspryng in MOGAD in Europe Positive data for: sefaxersen in an autoimmune condition affecting kidney function (phase III), Lunsumio in blood cancer (phase III), Tam-Peli in relapsed small-cell lung cancer (phase III) as well as enicepatide and petrelintide in overweight or obesity and type 2 diabetes (both phase II) US clearance for Elecsys pTau217 test, providing clinicians across primary and specialty care with a single-biomarker blood test to aid in identifying amyloid pathology associated with Alzheimer’s disease Launch of two new, real-time PCR tests to support public health epidemic response to the US outbreak of the Cyclospora cayetanensis parasite Delivery of molecular tests to support the Democratic Republic of the Congo health ministry-led response to the Ebola outbreak Manufacturing and R&D capacity expansion: Hillsboro injectable medicines facility and Innovation Center Boston for cardiovascular, renal and metabolic diseases in the US and small molecules facility in Basel, Switzerland Outlook for 2026 confirmed Roche CEO Thomas Schinecker: “In the third quarter, we delivered strong sales growth of +7% at constant exchange rates and +8% in Swiss francs. Most importantly, we continued to make meaningful progress for patients. We advanced another five potential new medicines into the final stage of development this year and now aim to bring up to 20 new medicines to patients by 2030. The US FDA granted Priority Review for fenebrutinib in both relapsing and primary progressive multiple sclerosis, bringing us closer to delivering the first high-efficacy, brain-penetrant oral therapy to patients. Giredestrant is also under FDA Priority Review in both early-stage and advanced breast cancer, and we are fully prepared to launch later this year, pending approval. In Diagnostics, we received US FDA clearance for Elecsys pTau217, the first and only FDA-cleared single-biomarker blood test for Alzheimer’s disease that supports both rule-in and rule-out assessment of amyloid pathology across primary and specialty care settings. We confirm our full-year outlook.” Outlook for 2026 Roche (SIX: RO, ROP; OTCQX: RHHBY) expects an increase in Group sales in the mid single digit range (CER) for 2026. Core earnings per share are targeted to develop in the high single digit range (CER). Roche expects to further increase its dividend in Swiss francs. SalesCHF millionsAs % of sales% change January–September 2026202520262025At CERIn CHFIn USD Group 46,49345,862100.0100.0+6+1+7 Pharmaceuticals Division36,21235,55577.977.5+7+2+8 United States18,71218,79840.241.0+50 Europe6,8196,81814.714.9+20 Japan2,3522,1395.14.7+25+10 International8,3297,80017.916.9+10+7 Diagnostics Division10,28110,30722.122.5+40+6 International: Asia-Pacific, CEETRIS (Central Eastern Europe, Türkiye, Russia and Indian subcontinent), Latin America, Middle East, Africa, Canada, others Group sales In the first nine months of 2026, Roche sales were +6% at CER, +1% when reported in CHF, to CHF 46.5 billion due to strong demand for pharmaceutical products and diagnostic solutions. The appreciation of the Swiss franc against most currencies, notably the US dollar, had a significant impact on the results reported in Swiss francs compared to constant exchange rates. This currency impact reversed in the third quarter. Sales growth in the Pharmaceuticals Division was +7% at CER, +2% when reported in CHF, to CHF 36.2 billion, with medicines for severe diseases continuing their strong growth. The top five growth drivers – Xolair, Hemlibra, Ocrevus, Phesgo and Vabysmo – achieved total sales of CHF 16.8 billion, an increase of +12% at CER, or +6% in CHF, compared to the first nine months of 2025. Sales of products with expired patents (Avastin, Herceptin, MabThera/Rituxan, Lucentis and Actemra/RoActemra) decreased by a combined CHF 0.4 billion at CER, or CHF 0.6 billion in CHF. In the United States, sales were +5% at CER, stable when reported in CHF, due to continued growth of Xolair, Hemlibra, Ocrevus, Polivy (blood cancer) and Tecentriq (cancer immunotherapy). This growth more than compensated for the lower sales of Kadcyla (breast cancer) and Perjeta (breast cancer). Sales in Europe were +2% at CER, stable when reported in CHF, as the growing demand for Ocrevus, Phesgo and Evrysdi (spinal muscular atrophy) more than offset the impact of biosimilar competition on Actemra/RoActemra and the conversion to Phesgo on Perjeta. In Japan, sales were +25% at CER, +10% when reported in CHF, mainly due to product supply to third parties and continued growth of Lunsumio (blood cancer), Hemlibra, Polivy, Elevidys (Duchenne muscular dystrophy) and Vabysmo. There was also a positive impact of timing effects related to the implementation of a new enterprise resource planning (ERP) system. Sales in the International region were +10% at CER, +7% when reported in CHF, led by higher sales of Phesgo, Vabysmo, Hemlibra, Ocrevus and Evrysdi. In China, sales were stable at CER and when reported in CHF, driven by continued growth of Phesgo, Vabysmo, Alecensa and Polivy. The increase was partially offset by lower sales of Perjeta due to the conversion to Phesgo and Xofluza due to a milder flu season in 2025. The Diagnostics Division’s sales were +4% at CER, stable when reported in CHF, to CHF 10.3 billion as growth in demand for core lab and pathology solutions more than offset the impact of healthcare pricing reforms in China. Sales in the Europe, Middle East and Africa (EMEA) region were +3% at CER, unchanged when reported in CHF, driven by higher sales of clinical chemistry and immunodiagnostic products. In North America, sales were +9% at CER, +3% when reported in CHF, with growth across the Core Lab, Pathology Lab and Molecular Lab customer areas. Sales in Asia-Pacific were -4% at CER, or -8% when reported in CHF, due to the healthcare pricing reforms in China. In Latin America, sales growth was +12% at CER, or +11% when reported in CHF. Pharmaceuticals: key developments CompoundMilestone Regulatory Enspryng Thyroid eye diseaseFDA approves Enspryng, a first-in-class IL-6R inhibitor, as the first and only at-home subcutaneous treatment option for thyroid eye disease (TED) FDA approval based on phase III SatraGO-1 and -2 studies, with SatraGO-2 demonstrating a significant reduction in eye bulging (proptosis) and improvement in diplopia (double vision), with a favourable safety profile, regardless of TED activity or duration. Enspryng (satralizumab) represents an important advance for people with TED, offering the first at-home subcutaneous treatment option every four weeks during maintenance phase, allowing for greater flexibility in how treatment is administered. Enspryng is an anti-IL-6R monoclonal antibody using novel recycling antibody technology designed to inhibit IL-6 signalling upstream of autoantibody-driven pathology. TED is a rare autoimmune disease affecting approximately 155 out of every 100,000 people in the US that can lead to facial disfigurement and vision-threatening complications if left untreated. More information: Media Release, 16 October 2026 Tecentriq Different types of cancerFDA approves Tecentriq in combination with a fluoropyrimidine and oxaliplatin for the adjuvant treatment of a certain type of stage III colon cancer The approval is based on results from the landmark phase III ATOMIC study, published in The New England Journal of Medicine, which showed Tecentriq plus chemotherapy reduced the risk of disease recurrence or death by 50% compared to chemotherapy alone. It is the first approved adjuvant immunotherapy regimen for stage III dMMR colon cancer, positioning Tecentriq as a new post-surgery standard of care. Nearly 25% of all colon cancers are diagnosed at stage III, and almost one in three patients with stage III colon cancer experience a recurrence within five years. Approval marks the twelfth indication for Tecentriq in the US. More information: Media Release, 9 October 2026 Fenebrutinib Multiple sclerosisFenebrutinib is the first BTK inhibitor to receive US FDA filing acceptance in both relapsing and primary progressive multiple sclerosis Fenebrutinib cut relapses by 51% and 58% vs teriflunomide in phase III RMS trials (FENhance 1 and 2) while showing a consistent, positive trend in delaying disability. Fenebrutinib became the first investigational medicine in more than a decade to slow disability progression in a phase III PPMS trial (FENtrepid), with numerical benefit vs Ocrevus. Fenebrutinib is designed to address two drivers of MS – acute inflammation causing relapses and chronic brain inflammation driving disability progression. If approved, fenebrutinib would become the first BTK inhibitor and first high-efficacy oral treatment for both RMS and PPMS, offering a new option for the nearly 1 million people living with MS in the US. More information: Media Release, 30 September 2026 Susvimo Severe eye diseasesEuropean Commission approves Susvimo for the treatment of neovascular age-related macular degeneration By continuously delivering medicine into the eye through the Contivue refillable implant, Susvimo is the first and only continuous delivery treatment that offers an alternative to standard-of-care eye injections for nAMD. Susvimo helps people with nAMD maintain their vision with as few as two treatments per year. Data from the phase III Archway study showed that Susvimo maintained vision equivalent to monthly intravitreal ranibizumab injections. nAMD is a leading cause of vision loss in adults over 60 and affects approximately 1.7 million people across the European Union. More information: Media Release, 21 September 2026 Enspryng MOGADFDA grants Priority Review for Enspryng for MOGAD, an autoimmune disease with no approved treatments If approved, Enspryng would be the first and only disease-modifying therapy for MOGAD (myelin oligodendrocyte glycoprotein antibody-associated disease). The filing acceptance is based on the phase III METEOROID study showing that Enspryng reduced the risk of relapses by 68%. The European Medicines Agency (EMA) has validated the application for Enspryng for MOGAD in Europe, with a decision expected in Q3 2027. More information: Media Release, 10 September 2026 Phase III, pivotal and other key read-outs Sefaxersen IgA nephropathyPositive interim data shows sefaxersen significantly reduces proteinuria in people with IgA nephropathy (IgAN) In the phase III IMAgINATION study, sefaxersen demonstrated statistically significant and clinically meaningful reductions in proteinuria versus placebo at 37 weeks, showing best-in-class potential. Sefaxersen inhibits complement factor B production at its primary source in the liver, thus blocking a key driver of IgAN-related kidney damage. Interim data will be presented at an upcoming medical meeting and shared with health authorities. More information: Media Release, 23 September 2026 Enicepatide ObesityRoche announces positive phase II results for dual GLP-1/GIP receptor agonist enicepatide in people living with type 2 diabetes and overweight or obesity At the highest dose (24 mg), enicepatide achieved a mean HbA1c reduction of 2.65% at 48 weeks, highlighting its potential for best-in-disease glycaemic control. By week 48, 90% of patients in the 24 mg enicepatide arm met the type-2-diabetes glycaemic target of ≤6.5% HbA1c, while 62% achieved normoglycaemia (HbA1c <5.7%). At the highest 24 mg dose, enicepatide achieved a mean weight loss of 15.5% at 48 weeks, without a weight loss plateau. More information: Media Release, 22 September 2026 Lunsumio Blood cancerRegimen based on Lunsumio significantly improves progression-free survival in follicular lymphoma in phase III CELESTIMO study Phase III CELESTIMO study met its primary endpoint at the interim analysis demonstrating a statistically significant and clinically meaningful reduction in the risk of disease progression in people with follicular lymphoma who have received at least one prior line of treatment. Data reinforce the potential of this regimen based on Lunsumio to improve clinical outcomes, while offering a tolerable safety profile, a simple dosing schedule and outpatient administration. CELESTIMO is the confirmatory study required to convert the accelerated approval / conditional marketing authorisation of Lunsumio monotherapy for third-line or later (3L+) follicular lymphoma to full approval, as well as to secure an indication in second-line or later (2L+) follicular lymphoma. Data will be submitted to health authorities and presented at an upcoming medical meeting. More information: Media Release, 17 September 2026 Tam-Peli Lung cancerRoche’s collaborator MediLink announces phase III data for Tam-Peli showing significantly improved overall survival in Chinese patient population with relapsed small-cell lung cancer Tambotatug pelitecan (Tam-Peli) demonstrated statistically significant efficacy over topotecan in a phase III study conducted in China, reducing the risk of death by 54% and disease progression by 71%, while achieving an objective response rate of 59.1% vs 9.7%. The novel B7-H3-targeted antibody-drug conjugate with a dual release mechanism of the payload is based on MediLink’s proprietary TMALIN platform, designed to maximise antitumour activity while minimising off-target toxicity. Roche is developing and commercialising Tam-Peli outside mainland China, Hong Kong and Macau across multiple tumour types, with plans to rapidly initiate global trials. Tam-Peli has received US FDA and China CDE Breakthrough Therapy Designations for relapsed small-cell lung cancer. More information: Media Release, 13 September 2026 Vabysmo Severe eye diseasesVabysmo demonstrates sustained two-year results in a difficult-to-treat form of nAMD The SALWEEN study showed significant improvements in vision and retinal health. More than 60% of Asian patients with polypoidal choroidal vasculopathy (PCV), an aggressive subtype of nAMD, treated with Vabysmo showed no signs of polypoidal lesions. By the end of year two, more than 60% of patients were on an extended 20-week treatment interval, reducing treatment burden. More information: Media Release, 28 August 2026 Other ESMO presentation Lung and breast cancer portfolio Roche to present pivotal data at ESMO 2026, showcasing advances across its lung and breast cancer late-stage portfolio Phase III Krascendo 1 results demonstrated divarasib’s superiority over current standard-of-care, first-generation KRAS G12C inhibitors in previously treated advanced G12C-mutated non-small cell lung cancer. Patient-reported outcomes from phase III lidERA study showed that improved efficacy of giredestrant over standard endocrine therapy is achieved without compromising tolerability and health-related quality of life in early-stage breast cancer. Phase III results in Chinese patients with metastatic nasopharyngeal carcinoma demonstrate the potential of Tam-Peli, a next-generation B7-H3-targeted ADC, to deliver robust efficacy with a favourable safety profile in high-unmet-need solid tumours. More information: Media Release, 19 October 2026 Vamikibart Uveitic macular edemaRoche presents new phase III one-year data for vamikibart in uveitic macular edema (UME), a serious cause of vision loss In the MEERKAT and SANDCAT studies, vamikibart demonstrated sustained improvements in vision and reductions in macular thickness in patients with UME at 52 weeks. UME is the leading cause of moderate and severe vision loss in patients with uveitis, posing a significant risk of blindness if left untreated. The FDA has accepted Roche’s Biologics License Application (BLA), with an approval decision expected by July 2027. More information: Media Release, 10 October 2026 Vabysmo Severe eye diseasesRoche presents new data at EURETINA, highlighting the real-world effectiveness and safety of Vabysmo across major retinal conditions New real-world results for Vabysmo in nAMD, diabetic macular edema and retinal vein occlusion reinforce robust effectiveness and durability across previously untreated and treated eyes, with no new safety signals. Advanced AI-enabled analysis of imaging confirms rapid and meaningful anatomical drying supporting Vabysmo as a standard-of-care therapy in routine clinical care. With more than 5,000 patients enrolled, VOYAGER is the largest, prospective, non-interventional real-world dataset evaluating Vabysmo across diverse clinical practice settings worldwide. More information: Media Release, 1 October 2026 Giredestrant Breast cancerGiredestrant combination significantly improved progression-free survival in ER-positive advanced breast cancer in phase III evERA data published in The New England Journal of Medicine Giredestrant plus everolimus reduced the risk of disease progression or death by 44% and 62% in ITT and ESR1-mutated populations, respectively, versus standard endocrine therapy plus everolimus. By targeting resistance to endocrine treatments, the giredestrant combination seeks to delay disease progression and improve overall patient outcomes. The FDA has set a PDUFA goal date for giredestrant in early-stage breast cancer of 30 November 2026 and in advanced disease of 18 December 2026. More information: Media Release, 1 October 2026 Board of Directors nominationRoche proposes Dr Christophe Weber, former CEO of Takeda Pharmaceuticals, for election to its Board of Directors at the 2027 Annual General Meeting Roche’s Board of Directors has approved to propose Dr Christophe Weber, former CEO of Takeda Pharmaceuticals, for election to the Board at the Annual General Meeting on 9 March 2027. Roche Chairman Severin Schwan highlighted Dr Weber’s extensive healthcare industry knowledge and leadership experience as valuable assets for the Board. Roche continues its commitment to transformative medicines and diagnostics, focusing on major disease areas and global healthcare challenges. More information: Media Release, 23 September 2026 Innovation Center BostonRoche announces grand opening of its Innovation Center Boston to drive advancements in cardiovascular, renal and metabolic diseases The centre will be a hub for Roche and Genentech, bringing together expertise in cardiovascular, renal and metabolic diseases, as well as for data science and AI specialists to drive innovation in drug discovery and development. It will expand Roche’s and Genentech’s presence in Boston, reflecting a long-term commitment to one of the world’s leading life sciences hubs. This is part of Roche and Genentech’s USD 50 billion investment in US manufacturing and R&D, building on recent investments and manufacturing milestones in Holly Springs, North Carolina, and Hillsboro, Oregon. More information: Media Release, 17 September 2026 Hillsboro facilityGenentech, Roche’s US subsidiary, announces a USD 750 million manufacturing expansion in Hillsboro, Oregon The new facility in Hillsboro, Oregon for the assembly of injectable medicines and delivery devices will further advance end-to-end US drug manufacturing capabilities. Approximately USD 750 million investment will double the size of the existing facility and is expected to create an additional 250 specialised manufacturing jobs. Flexible manufacturing capacity will support advanced drug delivery devices that can provide patients with more convenient ways to receive treatment. More information: Media Release, 20 August 2026 Pharmaceuticals sales SalesCHF millionsAs % of sales% change January–September2026202520262025At CERIn CHF Pharmaceuticals Division36,21235,555100.0100.0+7+2 United States18,71218,79851.752.9+50 Europe6,8196,81818.819.2+20 Japan2,3522,1396.56.0+25+10 International8,3297,80023.021.9+10+7 International: Asia-Pacific, CEETRIS (Central Eastern Europe, Türkiye, Russia and Indian subcontinent), Latin America, Middle East, Africa, Canada, others Top 20 best-selling pharmaceuticals (% change at CER1)TotalUnited StatesEuropeJapanInternational CHF m%CHF m%CHF m%CHF m%CHF m% Ocrevus Multiple sclerosis5,317+73,581+51,136+9--600+21 Hemlibra Haemophilia A3,750+122,006+9769+5291+20684+23 Vabysmo Eye diseases (nAMD, DME, RVO)3,196+102,060+2585+7131+41420+65 Tecentriq Cancer immunotherapy2,615+51,243+8626-2245+6501+9 Xolair3 Chronic hives, food allergies2,521+202,521+20------ Phesgo Breast cancer2,064+18486-1657+11152+24769+43 Perjeta3 Breast cancer2,040-8824-10361-1338-20817-3 Actemra/RoActemra3 RA, COVID-191,621-10795-9328-26232+14266-4 Evrysdi Spinal muscular atrophy1,470+18497+12504+1465+7404+33 Kadcyla3 Breast cancer1,339-9442-19370-565+9462-2 Polivy Blood cancer1,302+24606+29204-9176+30316+44 Alecensa Lung cancer1,213+6391-1189-3154+15479+15 MabThera/Rituxan3 Blood cancer, RA919+3605+1294-88-16212-10 Activase/TNKase3 Cardiac diseases830+6792+5----38+12 Gazyva/Gazyvaro3 Blood cancer, lupus nephritis751+7369+4176-228+28178+25 Herceptin3 Breast and gastric cancer695-12140-15205-63-35347-13 Avastin3 Various cancer types639-12195-856+556-43332-9 Columvi Blood cancer327+67146+2492+113--89+167 Enspryng Acute inflammation of brain, spinal cord and optic nerves319+2879+1834+18138+3068+42 Pulmozyme3 Cystic fibrosis303-12214-1143-111+3845-18 DME: diabetic macular edema / nAMD: neovascular or ‘wet’ age-related macular degeneration / RVO: retinal vein occlusion / RA: rheumatoid arthritis Diagnostics key developments ProductMilestone Elecsys pTau217 Alzheimer’s diseaseRoche receives FDA clearance for Elecsys pTau217, advancing Alzheimer’s disease assessment across primary and specialty care It is the first and only FDA-cleared, single-biomarker blood test supporting both rule-in and rule-out assessment of amyloid pathology across primary and specialty care settings. The test delivers consistency across clinical settings by using the same validated cut-offs in primary and specialty care. It is designed for broad implementation across Roche’s installed base of more than 4,500 cobas laboratory instruments in the US supporting access through existing laboratory infrastructure. More information: Investor Update, 24 August 2026 Diagnostics sales SalesCHF millionsAs % of sales% change January–September2026202520262025At CERIn CHF Diagnostics Division10,28110,307100.0100.0+40 Customer areas Core Lab5,7555,68856.055.2+5+1 Molecular Lab1,8361,86117.918.1+3-1 Near Patient Care1,3481,47713.114.3-5-9 Pathology Lab1,3421,28113.012.4+10+5 Regions Europe, Middle East, Africa3,6983,68636.035.8+30 North America3,3893,30532.932.1+9+3 Asia-Pacific2,3432,54722.824.7-4-8 Latin America8517698.37.4+12+11 More information on Roche’s performance in the first nine months of 2026: 9M 2026 presentation Appendix with tables About Roche Roche (SIX: RO, ROP; OTCQX: RHHBY) is a healthcare company uniquely placed to prevent, stop and cure diseases by uniting leading science and technology across diagnostics, medicines and digital solutions. Roche was founded in Basel, Switzerland in 1896 and today is a leading provider of transformative medicines and diagnostics for millions of people in over 150 countries around the world. It is dedicated to tackling healthcare challenges that place the greatest strain on patients, families, communities and healthcare systems. Across its Diagnostics and Pharmaceuticals Divisions, Roche focuses on areas including oncology, neurology, cardiovascular and metabolic diseases, ophthalmology, infectious diseases and immunology with the aim of providing real and positive change for patients, the people they love and the professionals who care for them. Genentech in the United States is a fully owned subsidiary in the Roche Group. Roche is the majority shareholder in Chugai Pharmaceutical, a major innovator in the Japanese therapeutic antibody market. For more information, please visit www.roche.com. All trademarks used or mentioned in this release are protected by law. References [1] CER (Constant Exchange Rates). The percentage changes at constant exchange rates are calculated using simulations by reconsolidating both the 2026 and 2025 results at constant exchange rates (the average rates for the year ended 31 December 2025). For the definition of CER, see page 178 of the Roche Finance Report 2025. [2] USD (US dollars). The percentage changes for selected sales figures at US dollars are calculated by translating both the 2026 and 2025 sales figures at the respective average US dollar exchange rate for the period in question. This supplementary information is provided to assist readers when assessing comparability with other companies. [3] Products launched before 2015. Cautionary statement regarding forward-looking statements This document contains certain forward-looking statements. These forward-looking statements may be identified by words such as ‘believes’, ‘expects’, ‘anticipates’, ‘projects’, ‘intends’, ‘should’, ‘seeks’, ‘estimates’, ‘future’ or similar expressions or by discussion of, among other things, strategy, goals, plans or intentions. Various factors may cause actual results to differ materially in the future from those reflected in forward-looking statements contained in this document, such as: (1) pricing and product initiatives of competitors; (2) legislative and regulatory developments and economic conditions; (3) delay or inability in obtaining regulatory approvals or bringing products to market; (4) fluctuations in currency exchange rates and general financial market conditions; (5) uncertainties in the discovery, development or marketing of new products or new uses of existing products, including without limitation negative results of clinical trials or research projects, unexpected side effects of pipeline or marketed products; (6) increased government pricing pressures; (7) interruptions in production; (8) loss of or inability to obtain adequate protection for intellectual property rights; (9) litigation; (10) loss of key executives or other employees; and (11) adverse publicity and news coverage. The statement regarding earnings per share growth is not a profit forecast and should not be interpreted to mean that Roche’s earnings or earnings per share for this or any subsequent period will necessarily match or exceed the historical published earnings or earnings per share of Roche. Roche Global Media Relations Phone: +41 61 688 88 88 / e-mail: media.relations@roche.com Tristan Schmitz Phone: +41 79 529 70 35Lorena Corfas Phone: +41 79 568 24 95 Simon Goldsborough Phone: +44 797 32 72 915Karsten Kleine Phone: +41 79 461 86 83 Kirti Pandey Phone: +41 79 398 38 53Yvette Petillon Phone: +41 79 961 92 50 Irène Stephan Phone: +41 79 377 83 75Albert Thottiyil Phone: +41 79 775 66 12 Roche Investor Relations Dr Bruno Eschli Phone: +41 61 687 5 284 e-mail: bruno.eschli@roche.comDr Sabine Borngräber Phone: +41 61 688 80 27 e-mail: sabine.borngraeber@roche.com Dr Birgit Masjost Phone: +41 61 688 48 14 e-mail: birgit.masjost@roche.com Investor Relations North America Loren Kalm Phone: +1 650 225 3217 e-mail: kalm.loren@gene.com Attachments Communications appendix tables_YTD Sep 2026_Sales_02102026 Media Investor Release Roche Q3 2026 English
Logo for UVO Acoustic Pods Exploring Acoustic Design, Product Features and Workplace Applications CALIFORNIA, CA, UNITED STATES, October 21, 2026 / EINPresswire.com / -- China, October 22, 2026 — This 2026 industry overview profiles five China-based companies associated with acoustic pods and flexible workplace solutions: HongKong UVO international group Co., LTD (UVO), Shanghai AG. ACOUSTIC Industrial Co., Ltd., Han
GitLab is not affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The GitLab application is not written in PHP and does not run it to serve web requests, and our Security team has found no evidence of impact to GitLab-managed infrastructure. GitLab.com, GitLab Self-Managed, and GitLab Dedicated are not impacted. PHP is a widely used programming language that runs on web servers and powers popular platforms like WordPress, Drupal, and Magento, so a flaw in PHP itself can affect many websites and applications. On October 21, 2026, the PHP project fixed two critical remote code execution flaws in PHP, together known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). PHP rates both 9.2 on CVSS v4.0. The flaws are in the PHP engine, not in any framework, library, or application code, so there is no application-level fix. Any web server that runs PHP is affected, including NGINX and Apache. The PHP project confirmed the vulnerability on Apache with mod_php, where an unauthenticated request can achieve remote code execution before any application code runs. Upgrade every server and container that runs PHP to serve web requests to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or to your distribution’s patched package now. This guide is for security and platform teams with PHP projects on GitLab. It covers the fixed version for each PHP branch and distribution, how to use GitLab features to locate PHP projects across your groups, how to track remediation, and how to check for signs of compromise. Upgrade PHP to a fixed version now Upgrade the PHP runtime on every host and in every container image to a fixed version. Framework updates, Composer updates, input validation, and authentication don’t help, because PHP handles the request before application code runs. BranchFixed in PHP 8.5.x8.5.12 PHP 8.4.x8.4.27 PHP 8.3.x8.3.36 PHP 8.2.x8.2.35 (end of life December 31, 2026) PHP 8.6 release candidates8.6.0RC4. The official php:8.6-rc image was still on RC3 on October 21, and RC3 does not have the fix. PHP 8.1 and olderNo official release. PHP published minimal source backports for 7.4, 8.0, and 8.1, and some distributions ship patched packages. If your PHP comes from a distribution package, upgrade that package. Fixed package versions as of October 22: DistributionFixed package Ubuntu 26.04php8.5 8.5.4-0ubuntu1.5 Ubuntu 24.04php8.3 8.3.6-0ubuntu0.24.04.13 Ubuntu 22.04php8.1 8.1.2-1ubuntu2.28 Debian 13php8.4 8.4.27-1~deb13u1 Debian 12php8.2 8.2.35-1~deb12u1 Alpine 3.24php83 8.3.36, php84 8.4.27, php85 8.5.12 RHEL 10php 8.3.36-1.el10_2 (RHSA-2026:87070), php8.4 8.4.27-1.el10_2 (RHSA-2026:87071) RHEL 9php 8.0.30-8.el9_8.1 (RHSA-2026:87151), php:8.2 8.2.35-1 (RHSA-2026:87072), php:8.3 8.3.36-1 (RHSA-2026:87079); php:8.4 had no fix yet on October 22 RHEL 8php:7.4 7.4.33-8 (RHSA-2026:87080); check Red Hat’s CVE pages for php:8.2. Retired streams (7.2, 7.3, 8.0) get no fix Sources: Ubuntu, Debian, Alpine, and Red Hat security trackers, as of October 22, 2026. Ubuntu, and Red Hat for its 7.4 and 8.0 packages, keep the old upstream version number and backport the fix. Compare the package versions rather than php -v. Restart every process that runs PHP after upgrading. Rebuild your container images. If your image uses a floating tag of the official php image, such as php:8, php:8.3, php:8.3-apache or php:latest, rebuild it with docker build --pull and redeploy it. Images that pin a patch version, such as php:8.3.35-apache, need the tag changed to the fixed version first. Images built on derivatives such as wordpress or drupal get the fix only after their maintainers publish an updated image, so check the upstream image before you rebuild. Locate PHP projects across your GitLab groups Any project that runs PHP to serve web requests needs a fixed version, including the ones that are easy to forget, such as an internal dashboard, a marketing site, or a CI job image. Finding them takes two views: a static search of what your repositories declare and your images contain, and a runtime inventory of what actually runs. GitLab covers the static view with two features. Use both, in this order. 1. Container scanning Container scanning reports vulnerabilities in operating system packages, so it finds PHP installed with apt, apk, or dnf, and it reports the two CVEs once they reach the scanner’s vulnerability database. To turn it on for a project, add the template to .gitlab-ci.yml: include: - template: Security/Container-Scanning.gitlab-ci.yml You can also use a group-level scan execution policy to turn container scanning on for every project in a group at once. When a policy is enabled, the next time a pipeline is run, it will be run with container scanning. Container scanning results for the default branch can be reviewed in the Vulnerability Report after the scanner completes. Additionally, you can set up Merge Request Approval policies with container scanning. With merge request approvals in play, if a code change contains PHP2Shell, the policy will block a merge without approval from the selected parties. Container scanning detects only PHP installed as a package. PHP compiled from source, including the official php images, has no package record, so a project can pass container scanning and still run a vulnerable PHP. Code search covers that gap. 2. Code search Exact code search can find the two types of files that indicate a PHP project. Run these at the top-level group with regular expression mode enabled (the .* toggle at the right of the search box): Container base images: This query searches for every file GitLab detects as a Dockerfile. The pattern matches any image whose name or tag contains php, so it also finds derivatives such as wordpress, frankenphp, or bitnami/php-fpm. Expect a few false positives that you can rule out by reading the result: lang:Dockerfile ^FROM.*php Composer projects: This query finds projects that use PHP even when they have no Dockerfile, or when the Dockerfile takes its image from a build argument such as FROM $BASE_IMAGE: file:composer\.json$ Exact code search covers the default branch only. On GitLab.com it is on by default for paid plans. On GitLab Self-Managed instances an administrator must install Zoekt first. GitLab Dedicated doesn’t support exact code search. For each result, confirm the version. You can check the FROM php:<tag> line, or run php -v in the running container, and compare it with the table above. The group dependency list shows Composer packages and framework versions but not the PHP runtime version. 3. Compare with your runtime inventory Container scanning and code search show what your projects declare and build, not what runs. PHP can run outside your GitLab projects, for example on web servers with mod_php or PHP-FPM enabled only in their configuration, on hosts configured by hand, or in containers that still run in clusters without an active pipeline. Compare the static results with an inventory of your running workloads from your configuration management (Ansible, Puppet, Chef, etc.), cloud, or VM inventory tools. For Kubernetes, operational container scanning scans the images that run in your clusters, with the same package-only detection as container scanning. Treat every PHP runtime that appears in only one of the two views as a gap to investigate. Remediate at scale with GitLab Duo Agent Platform Start with asking GitLab Duo Agentic Chat to: collect every container scanning finding for CVE-2026-109618 and CVE-2026-109619 across the group from the vulnerability report (requires an Ultimate subscription) run the code search queries above across the group, review each hit and read the PHP version from the Dockerfile or the Composer files open a merge request per affected project that bumps the base image tag or the package to the fixed version, and assign it to the right maintainer track the whole effort in an epic with one issue per project, and is closed when the fixed version is deployed and confirmed From each issue, the Developer Flow can open a merge request that updates the base image tag or package to a fixed version. Turn on automatic reviews with the Code Review Flow to get a first review that follows your custom review instructions. Review and merge each merge request, then close the issue once the fixed version is deployed. Searches find candidates, but a security or platform engineer still has to review each match, resolve CI includes, and tell what the code declares apart from what actually runs. An example agent skill from the GitLab Developer Advocacy team handles this work. It runs on GitLab Duo Agent Platform and with agents that use GitLab MCP server or the glab CLI, such as Claude Code, Codex, and Cursor. The skill checks container images, CI jobs, OS packages, configuration management variables, Composer pins, and environments. It returns a cited findings table with deployment evidence, and open gaps. The skill is read-only: It makes no changes, and remediation merge requests remain a separate, reviewed step. It cannot confirm what is running on hosts it cannot access, so verify those directly. Adapt the skill to your own environment before you use it. Check for compromise Reports of exploitation differ. Security researchers reported an exploit attempt on October 17, 2026, before public disclosure, and further reports of exploitation followed the release. The PHP project identified no functional exploits at the time of release. If an internet-facing server ran a vulnerable PHP version, review its logs from October 17, 2026, onward for: Multipart requests followed by memory-limit errors or repeated HTTP 500 responses Unusually large or malformed PHPSESSID response cookies Unexplained PHP worker restarts, or shell processes started by PHP workers Unexpected files on the PHP web server, outbound connections from PHP workers, or unexpected cron entries A successful exploit can return HTTP 200 and leave the worker running, so an absence of errors doesn’t rule out compromise. If you find signs of exploitation, isolate the server and start an incident investigation. Where possible, capture memory, disk, and logs before patching and restarting. Restarting PHP workers may erase evidence. CVE-2026-109619 can also expose process memory, even when an attacker doesn’t achieve code execution. Rotate any credentials, tokens, or keys the PHP process could read. Note: Scanners may flag the Gemnasium dependency scanning image (gemnasium:6), deprecated since GitLab 17.9, for its bundled PHP. It is used only as a command-line tool and never handles HTTP requests, so it is not exploitable, and a fixed version has already shipped under the same tag. Timeline DateWhat happened August 1Calif discovers the first flaw during an AI-assisted PHP audit and reports it to PHP on August 11; Wiz Research independently finds and reports the flaws on August 24. October 17Amazon’s honeypots record the first known exploit attempt, while the flaws are still under embargo. October 20PHP announces that a security release fixing two critical vulnerabilities will ship on October 21. October 20Vulnerability details leak before coordinated disclosure. (Huntress) October 21, 14:00 UTCPHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and publishes the advisories. html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}
Plugg Technologies Latin America Hiring From venture capital and AI to cross-border investment and technology talent; the Plugg Technologies podcast with 100+ episodes, kicks off its 5th season What started as an opportunity to share those stories has evolved into 100 conversations with founders, investors, and executives who are actively shaping the future of business in Latin America.” — Brian Samson (Founder) ATLA
For approximately 160 aspiring aviators from across the Atlanta metro, Oct. 20 was the day the sky stopped being the limit. Students boarded Delta’s 26th annual DREAM Flight at Hartsfield-Jackson Atlanta International Airport for the Airbus U.S. Manufacturing Facility in Mobile, Ala., for a firsthand look at the careers that could one day be theirs. Students from local Atlanta schools and organizations including, Rex Mill Middle, Elite Scholars, the Kindezi Schools, Morrow High School, OBAP ACE Academy and The Atlanta Chapter of Tuskegee Airmen S.T.R.E.A.M. Program spent the day exploring what it takes to connect the world through flight and meeting the people who make it happen. Rotating through four interactive experiences, students toured the Airbus A320 Final Assembly Line and took part in a scavenger hunt on aircraft manufacturing. They tackled aviation-themed activities and challenges at the Old Canteen Center, operated drones and flight simulators at Flight Works and explored the Advanced Manufacturing Program and facilities at Bishop State Community College. Before heading home, students heard from a panel of Delta and Airbus leaders at Bishop State, including Kurt Ford, Managing Director of Flight Training; William Cossey, Managing Director of Supply Chain Management; Tyesha Gray, Director of Human Resources; Julian Anugom, Director of In-Flight Entertainment and Connectivity; and Roderick Rogers, Head of A220 Quality Product Improvement at Airbus. These leaders shared their own career journeys and answered questions about navigating the industry. “Every student on this flight has the potential to become a pilot, engineer, technician or leader. Representation can be a powerful catalyst for unlocking potential, especially when students see people who look like them building, flying and leading in this industry. Delta’s DREAM Flight helps them better understand the variety of career pathways in the aviation industry,” said Keyra Lynn Johnson, Chief Diversity, Equity, Inclusion & Social Impact Officer. DREAM Flight’s founder honored This year, former Delta pilot and U.S. Air Force veteran John Bailey was inducted into the OBAP Hall of Fame at the organization’s annual conference. The honor recognizes Captain Bailey’s long career dedicated to opening doors for young people who dream of flying, from helping bring OBAP’s ACE Academy to Delta to founding Delta’s DREAM Flight. After flying military transport aircraft for the U.S. Air Force, including missions in Vietnam, Bailey joined Delta in 1973. As a newly hired pilot based in Boston, he often flew round-robin charter flights around the city for terminally ill children, and those flights sparked the idea to create a similar experience for kids who dreamed of becoming pilots. In July 2000, Bailey piloted the first DREAM Flight to the Smithsonian Air and Space Museum in Washington, D.C., with 150 students from Atlanta City Schools on board. An all-Black crew of Delta pilots volunteered their time to operate the flight, and members of the Tuskegee Airmen greeted students in Washington. They returned to Atlanta on time, and 26 years later, DREAM Flight remains a one-day journey from takeoff to touchdown. Growing the next generation of aviators Delta’s DREAM Flight bridges the gap between early curiosity and future career options by building students’ interest in aviation through fun, hands-on educational experiences and pairing them with mentors. By making these foundational experiences readily available and financially accessible, Delta’s partnership with OBAP has successfully reached more than 4,000 young people to date. Many DREAM Flight alumni have gone on to build careers at Delta, including: First Officer Kyle Foley was just 12 years old when he boarded the very first DREAM Flight in 2000. Seeing the pilots and controls up close for the first time set him on a path that led to a career flying for Delta. First Officer Curtis Jackson took DREAM Flight as a teen and grew up looking up to Bailey as one of Delta’s pioneering pilots. Bailey’s advice to keep pushing himself until he reached his goals stayed with Jackson on his path to the flight deck. DREAM Flight is one of several Delta programs, including WING Flight, ACE Academy and the National Flight Academy, that introduce students to aviation careers and expand the aviation talent pipeline. Working together to expand horizons Airbus and Delta have long shared common goals for the future of travel from the talent in the industry to the aircraft to get us there. Earlier this year, Delta announced the addition of 31 next-generation Airbus widebody aircraft to its fleet, an investment that will fuel international growth and accelerate fleet renewal in the years to come. “We talk a lot about the future of aviation, but you can’t actually build that future without bringing new voices and fresh perspectives into the fold,” said Roderick Rogers, Head of A220 Quality Product Improvement in Mobile. “Opening our doors in Mobile to Delta’s DREAM flight is our way of showing these students that there is a very real, accessible place for them in this industry, whether that's in the cockpit or right here on the manufacturing floor.” Mobile is one of five cities worldwide where Airbus commercial aircraft are assembled. The Mobile Airbus U.S. Manufacturing Facility has more than 2,000 employees who produce A320 and A220 Family aircraft for customers in the U.S. and Latin America. Earlier this fall, Delta and Airbus also partnered on Delta’s 11th annual WING (Women Inspiring Next Generation) Flight, which brought 160 young women from Atlanta to the same Mobile facility in celebration of Girls in Aviation Day.
Perceived value of 401(k)s rose +2x since 2024. Plan sponsors are focused on participant understanding, retirement readiness and personalized engagement. New York - Morgan Stanley today released findings from its 2026 Retirement Plan Survey , showing plan sponsors now believe defined contribution (DC) plans have become employees’ most valued workplace benefit, tied only with healthcare. This increased emphasis on 401
Agents are working across your team's software development lifecycle, but most still operate as separate tools, leaving the context, handoffs, and permissions for your team to stitch together. When your agents use APIs for these disparate tools, they often guess at endpoints and use up their context window on extra calls. The GitLab MCP server, now generally available with GitLab 19.5, connects your team’s external agents to your entire software lifecycle — from planning through production. The GitLab MCP server enables any MCP-compatible agent to run GitLab workflows from the client your team already works in, getting what it needs in fewer calls and with less context bloat. Agents can work across code, merge requests, work items, and pipelines, and hand work to agentic flows within GitLab Duo Agent Platform. Each action runs under your existing GitLab permissions. Built for how agents work APIs are built for developers writing code. An agent that uses one has to work out which endpoints to call and make several calls to assemble one answer. Model Context Protocol (MCP) is an open standard built for agents. An MCP server tells an agent what it can do and offers a curated set of tools designed around real workflows. Agents get the tools they need with more focused context, in fewer calls, and needing less data to carry through each task. The GitLab MCP server applies that approach to your workflows across your projects, supporting all your team members within the GitLab permissions you already set. Whether you're a developer handing a task to an agent or a team deciding how agents should work across your organization, your agents get tool coverage broad enough to complete the work, with access that follows each user’s GitLab permissions. Developers can even start GitLab Duo Agent Platform flows from the MCP-compatible coding agent they already use. Here is Claude Code using the GitLab MCP server to start the Fix Pipeline flow in Duo Agent Platform: More of your workflow, within reach of an agent In addition to the tools announced in 19.4, the GitLab MCP server now includes more tools for working with code and pipelines, and for finding the right group or doc. Code: add_branch starts a feature branch, get_repository_file reads a file at any ref, and semantic_search finds code by meaning, answering "where is this implemented?" without knowing the file or symbol name. Pipelines: get_pipeline shows why a pipeline is red, with its jobs, downstream pipelines, and artifacts on request. list_pipelines surfaces patterns across recent runs, and get_artifact_file reads a single file from a job's artifacts, such as a log, report, or test fixture, without downloading the whole archive. Orientation: list_groups lets an agent browse your group hierarchy to find the right group instead of guessing at identifiers, and list_wiki_pages, an opt-in tool, surfaces runbooks and docs before it answers a how-to question. In 19.5, the MCP server tool catalog is also simpler to work with. Related tools are now consolidated, with fewer tools doing more. get_merge_request lets you ask your agent for a merge request’s commits, diffs, pipelines, conflicts, or notes. get_pipeline now includes get_pipeline_jobs, so you can ask for a pipeline’s jobs along with the pipeline itself. Your agents spend less time choosing the right tool and pull in only the details a task needs. Toolsets let you choose which groups of tools the server returns. Each agent works from a focused set of tools that fits your team’s workflow instead of everything the server offers. A smaller set makes it less likely that an agent picks the wrong tool and has to retry. Most groups are on by default, and code security and wikis are available as opt-in groups. Browse the full catalog in the tools reference. Start GitLab flows without leaving your client Calling tools is one way an agent works with GitLab. Now, an agent can also hand a job to GitLab Duo Agent Platform and follow that job to the result without leaving your client. It can find the flows a project offers with list_duo_agents_and_flows, start a new flow from a goal in plain language with start_duo_session, and check progress with get_duo_session and list_duo_sessions. The work runs in a CI job inside GitLab, under the same context layer, policy checks, and audit trail as any other Duo Agent Platform session. When a session needs a decision, it pauses for your input. With send_duo_session_input, you approve or reject the agent’s proposed action, or answer its question, and the session picks back up, keeping you in the loop. The duo_agent_platform toolset is included by default alongside the rest of the GitLab MCP server's tools. Connect your agents to GitLab today The agents supporting your software lifecycle will continue evolving. As your team adopts new agents, the GitLab MCP server connects each one to GitLab’s tools and flows, so they’re productive from day one. You can connect the agents your team already uses by following the MCP server documentation, which includes setup instructions for Claude Code, Claude Desktop, Cursor, GitHub Copilot, OpenAI Codex, Gemini, Kiro, Zed, and other MCP-compatible clients. The GitLab MCP server is available on the Free, Premium, and Ultimate tiers, on GitLab.com, GitLab Self-Managed, and GitLab Dedicated. On GitLab.com, per-user rate limits are set at 60 calls per minute on Free and 600 on Premium and Ultimate. If you’re new to Duo Agent Platform, start a free trial. Already on Premium or Ultimate? Turn on Duo Agent Platform and use the GitLab Credits included with your subscription.
The code is written. Now who reviews it? The volume of code has never been greater, but delivery hasn’t kept pace. At Meta, code changes on internal platforms grew 220% year over year, while changes that reached users as new features grew only 36% (Reuters, August 2026). Every one of those changes has to clear review before it reaches users. Automated review absorbs much of that load. Code Review Flow in GitLab Duo Agent Platform reviews merge requests as they arrive, follows custom review instructions you define per project, and costs a flat 0.25 GitLab Credits per review ($0.25 at list price). If a manual review takes about 15 minutes of a senior engineer’s time, that’s roughly $25 per review, so automated review cuts per-review cost by 99% (GitLab). Automated review doesn’t take people out of the loop. Approval rules, CODEOWNERS, and compliance policies still require a person to sign off on many changes. For those merge requests, the first slowdown is often finding the right reviewer, and it happens before anyone reads a line. The right reviewer needs expertise in the code being changed, room in their queue, and availability in a time zone where they can respond quickly. When authors can’t see those factors, a few senior engineers carry most of the reviews while other qualified reviewers sit idle. GitLab 19.5 removes that step with Recommend Reviewers Flow. When you create a merge request, GitLab recommends the best individual reviewer based on workload, time zone, availability, and expertise defined by approval rules and CODEOWNERS. The flow explains why it chose that reviewer and lets you assign them in one click. Across your engineering organization, reviews start sooner, review load spreads across every qualified engineer, and more of the code your team writes reaches users. Watch Recommend Reviewers Flow in action: Review is a routing problem, not a headcount problem Teams often treat slow reviews as a people problem. They add reminders, review rotations, extended time zone coverage, and escalations. Those workarounds cost people time and can lead to burnout, and they leave the real cause untouched: routing. The expertise and capacity already exist; there’s just nothing to match them to each merge request as it arrives. Without that match, the author has to answer questions GitLab already can. Who knows this part of the codebase? Who has room in their queue? Who is online right now? Authors fall back on habits that slow everyone down: Assigning a whole group. Everyone gets notified, nobody feels responsible, and the merge request waits for a volunteer. Defaulting to the same trusted reviewer. That person becomes a bottleneck, and their own work stalls. Guessing across time zones. The reviewer you picked just signed off for the day, so your feedback arrives tomorrow. Reviewers pay a price, too. Group assignments flood their notifications with merge requests they will never review, which makes the ones that need them easier to miss. And the reviewers everyone defaults to absorb a growing share of the queue on top of their own work, which wears them down faster. How intelligent reviewer suggestions work GitLab Duo Agent Platform runs Recommend Reviewers Flow on your merge request and does the research for you: You create your merge request. A trigger starts the flow automatically when a merge request is created, whether in draft or ready state, so suggestions arrive from the start. The flow evaluates eligible reviewers. It weighs each candidate’s workload, time zone, availability, and expertise as defined by approval rules and CODEOWNERS, to find the person best suited and positioned to respond. You see the recommendation and the reasoning. The flow explains why it chose each reviewer, so you can approve the suggestion based on that context. You assign with one click. Suggestions appear in a dedicated panel on the merge request. You decide who reviews and when. This design keeps you in control of timing. You can finish iterating or address automated code review feedback first, then bring in a human reviewer when the change is truly ready. You set it up as a flow trigger in your project rather than a project setting, so it fits alongside the other agentic workflows your team already runs. What your team gains The right reviewer match means faster feedback, clearer accountability, and a more balanced workload. Recommend Reviewers Flow makes that call consistently, at scale, and with reasoning you can see and override. Recommend Reviewers Flow also works alongside the other foundational flows in GitLab Duo Agent Platform that handle the work around a merge request: Run Code Review Flow first, so automated feedback lands before a person is brought in. Add Security Review Flow to check merge request changes for business logic vulnerabilities before they merge. Use Fix CI/CD Pipeline Flow to diagnose and repair failed jobs, so a broken pipeline doesn’t hold up an approved change. Use Custom Flows to build Recommend Reviewers Flow into the process your team already follows. Each step from merge request to merge runs on the same platform, under the same policies, so more of the code your team writes actually reaches users. Get started Intelligent reviewer suggestions are generally available in GitLab 19.5 for GitLab.com, GitLab Self-Managed, and GitLab Dedicated. To try them, add the Recommend Reviewers Flow trigger to your project, then create your next merge request. Learn more in our documentation. New to GitLab Duo Agent Platform? Start a free trial today. Already a GitLab Premium or Ultimate subscriber? Turn on Duo Agent Platform and use the GitLab Credits included with your subscription.
Credentials often start in an engineer's local dev environments, then get copied into unscoped CI/CD variables to keep pipelines running. Stored there as a raw value rather than a reference to a scoped secret, a signing key reaches every job in the pipeline — compromised or not. Standing up a standalone vault narrows that exposure but requires mirroring every change to project membership, protected branches, and production environments. When the vault falls out of sync, a pipeline breaks or an agent’s service account keeps access it no longer needs. GitLab Secrets Manager tightens credential security without a second permission model. It is now generally available in GitLab 19.5 for Premium and Ultimate on GitLab.com and GitLab Self-Managed, with GitLab Dedicated coming soon. Built on OpenBao, it stores build-time and runtime credentials under the same permissions and audit trail as your code. Platform teams can offer developers self-service secrets, and security teams get credentials scoped to the jobs that use them, plus the pipeline and job ID on every CI/CD read. "GitLab Secrets Manager lets us centralize secrets across CI/CD, Kubernetes, and infrastructure as code without standing up multiple vaults or maintaining separate integration points. It also strengthens our supply chain security by tightening which users and pipelines can access a given credential." - Jeremy Nauta, Software Architect, OneTrust How Secrets Manager scopes build-time secrets to each job Agents can take actions no one anticipated, so security teams need to regard every job as if its agents will use any credential it can reach. Secrets Manager narrows what agents can reach with the context GitLab already holds about each job: its project, the branch it runs on, whether that branch is protected, and the environment it targets. A developer declares the secret a job needs with the secrets: keyword in .gitlab-ci.yml, and GitLab injects the value only into jobs that declare it and fall within its scope. Scope conditions accept wildcards on branch and environment, and they combine, so one rule can require a protected branch and a production/* environment before a job receives the credential. Inside the job, GitLab writes the value to a temporary file and exposes only its path, which limits exposure in subprocesses, crash dumps, and telemetry. GitLab masks the value in job logs and discards it when the job ends. Unlike a CI/CD variable, a secret is never readable in your project configuration. OpenBao encrypts secrets at rest with AES-256-GCM, so a copy of the secrets database holds only ciphertext. Jobs fetch values straight from OpenBao with short-lived tokens bound to each job’s identity, which keeps plaintext secrets out of the GitLab application. See how to get started with Secrets Manager: Revoke and trace an exposed credential When the axios npm package was compromised, a SANS advisory warned teams to "assume all environment variables on affected systems were exfiltrated" and extend investigations to CI/CD runners and build infrastructure. Responders had to work out which credentials each affected job could read, how to cut off access, and which runs read them. With Secrets Manager, when a job runs a poisoned dependency, the exposure stops at the secrets that job declared and was authorized to read. To clean up, revoke and replace the leaked credential, update the value in Secrets Manager, and audit that one job while other pipelines keep running. Secrets Manager prompts you to set a rotation reminder when you create a secret. Dynamic credentials are coming soon and will provide ephemeral access without manual rotation. GitLab streams every secret create, read, update, and delete event to your audit event destinations and records changes in the audit trail. Each pipeline read carries the pipeline and job IDs, which tie to the commit, the triggering user, and the merge request, when there is one. Incident responders and auditors can trace a read to the change behind it without correlating logs from a CI system, a vault, and an identity provider. Audit events never contain secret values. Govern secrets with the permissions that govern your code As agents take on more work, platform teams field more requests for pipelines and service accounts that need credentials. When those requests queue, teams fall back on broad grants and shared secrets. Secrets Manager uses the GitLab namespace as its isolation boundary. Projects inherit secrets defined in the groups above them, so you define a shared credential once. Owners grant read, write, and delete permissions to specific users or default roles, using the same membership model that governs the code. Remove a person or an agent's service account from a project, and that identity's access to the project's secrets ends. Developers reference secrets through the project access they already hold. When a secret reference breaks, they fix it in the same merge request as the code, with no second repository, approver, or access ticket. With a governed credential one line away, fewer secrets end up in over-scoped CI/CD variables, local files, or the repository. One store for pipelines and runtime workloads Kubernetes, Terraform, and scripts often get separate secret stores, each with its own access model and logs. Secrets Manager serves runtime tools from the same store as pipelines, under the same permissions and audit trail: Kubernetes, through External Secrets Operator. ESO re-fetches the secret on a set interval and updates the Kubernetes Secret in place, so a rotated value reaches the cluster without a pipeline run. Terraform and OpenTofu. They read a secret as a data source at plan or apply time and keep credentials out of .tfvars files and CI/CD variables. OpenBao and Vault CLIs, through the Vault-compatible API. Teams keep their existing scripts and point them at Secrets Manager. Other runtime tools, through the Secrets Manager API. Each runtime tool authenticates with a service account or an access token, and that identity needs project membership and explicit read permission for the secret. GitLab then issues a separate token, valid for five minutes, that the tool uses to fetch it. How Secrets Manager fits with GitLab's supply chain controls GitLab’s governed software factory connects code, pipelines, packages, and secrets on one platform, with one identity model and one record of how a change reached production. Dependency Firewall decides which packages enter a pipeline, Secrets Manager limits which credentials the pipeline can reach, and Artifact Central governs what you ship. Secrets Manager supports two of the five stages in the GitLab Security Standard, GitLab's framework for letting agents earn autonomy: For Authorize, it binds each job to the secrets its identity and scope allow, and for Respond, it streams every CRUD event. Secret push protection blocks commits containing credentials before they reach the repository, and Secret detection finds the ones already in your code and history. GitLab Duo Agent Platform triages what those scans find and flags likely false positives, so your team revokes, rotates, and audits only real leaks. GitLab's existing integrations for HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and Google Cloud Secret Manager keep working alongside Secrets Manager, so you can migrate at your own pace. Get started GitLab Secrets Manager is a paid add-on for Premium and Ultimate, billed through GitLab Credits: 1 credit per secret stored per month, and 1 credit per 2,500 read operations. An enterprise license agreement is available for air-gapped environments. On GitLab.com, top-level group Owners can try GitLab Secrets Manager free for 30 days or 500 evaluation credits, whichever ends first. Go to your top-level group, select Secure > Secrets Manager, then Start 30-day trial. On GitLab Self-Managed, your administrator must install and enable Secrets Manager, following the documented sizing and high-availability guidance. GitLab Dedicated support is coming soon. To find the first credentials to move, run the secret audit tool for CI/CD variables, which flags variables likely to hold credentials. A migration workflow for CI/CD variables is in development. Have suggestions or feedback? Share them in the Secrets Manager feedback issue.