GoKawiilAlpine Linux rebuilds GitLab server after attempted RCE exploit attempt
Attackers tried to exploit CVE-2026-97229, a maximum-severity remote code execution flaw in GitLab's CI/CD regex compiler, against Alpine Linux's development infrastructure on October 20-21, repeatedly crashing GitLab processes. Alpine found no direct evidence code was executed or packages tampered with, but due to missing logs it could not rule out compromise, so it rebuilt its GitLab instance and reset all passwords.
GoKawiil's interpretation of the reporting above, not reported fact.
Alpine's GitLab hosts the 'aports' build recipes behind its packages, which underpin countless Docker container images, so a successful compromise could have had wide supply-chain consequences. The incident also shows how patch timing can leave gaps: Alpine initially deployed an unpatched GitLab version, and a later upgrade still missed the fix because it depended on a bundled Ruby patch that Alpine's custom build didn't include.
- Attackers targeted Alpine Linux's GitLab server using a maximum-severity RCE flaw, CVE-2026-97229, on October 20-21.
- Alpine rebuilt its GitLab instance and reset all passwords after being unable to rule out compromise due to missing logs.
- Alpine's custom GitLab deployment remained vulnerable even after an upgrade because the fix relied on a bundled Ruby patch it lacked.
Source: bleepingcomputer.com, 2026-11-01
Published there as: “Alpine Linux rebuilds GitLab after attempted RCE attack”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.