> Knowing GitLab and its history of security vulnerabilities, the timing is probably just a coincidence.

You're probably right - unless Ukraine has more GL instances than most countries, in which case I'd be a little less likely to believe it's just a coincidence. Russia is deploying lots of attacks now so regardless of where the software was developed, if it's used in Ukraine at all it's more likely that we will find out about its vulnerabilities in the coming days.