Alpine Linux rebuilds GitLab after attempted RCE attack
Attackers attempted to exploit CVE-2026-97229 in Alpine Linux GitLab on October 20–21, prompting a full rebuild and password reset with no confirmed compromise.
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20–21. The attacks targeted CVE-2026-97229, repeatedly crashing processes and coming close to success. Alpine Linux rebuilt the GitLab instance from scratch and reset all passwords after finding no evidence of code execution or tampering, though compromise could not be ruled out due to missing logs.
Unconfirmed: Alpine Linux could not rule out successful compromise due to missing logs and lack of outbound records
- Eight worker crashes occurred from malicious CI configurations
- No tampering detected in commits, packages or releases up to October 27
- Alpine advises users to reset passwords and pull alpinelinux/gitlab:19.3.6 image
- Attackers downloaded the container image before the incident
- The flaw is an integer overflow in GitLab's Onigmo regex compiler
Impact: potential remote code execution and data exposure
- 1.reset all GitLab passwords
- 2.pull alpinelinux/gitlab:19.3.6 container image
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 | 27% | KEVPoC ×6 | KEV |
From the original article
2 min read at bleepingcomputer.com
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.