Alpine Linux Rebuilds GitLab Server After Attack
The open-source project took defensive action after hackers repeatedly targeted a critical vulnerability in its infrastructure on October 20-21.
Radwan AbdulhadiEditor and technology writer
Infrastructure Overhaul Following Security Incidents
Alpine Linux has completely rebuilt its GitLab server and reset all user passwords following an attempted exploit of its development infrastructure. As reported by BleepingComputer, the security incident unfolded on October 20 and October 21 when hackers repeatedly targeted the system.
The attacks specifically targeted CVE-2026-97229, a maximum-severity remote code execution flaw. During the attempts, GitLab processes crashed multiple times, and some exploitation attempts came dangerously close to succeeding.
Vulnerability Details and Missing Patches
CVE-2026-97229 is an integer overflow vulnerability located within GitLab's CI/CD regular expression compiler Onigmo, which is bundled inside Ruby. The flaw allows unauthenticated attackers to execute arbitrary code on the affected server. GitLab originally disclosed the flaw and issued fixes on October 12, as detailed in coverage where GitLab warned of max severity code execution vulnerability.
Initially, Alpine Linux installed GitLab version 19.3.4 rather than the patched 19.3.5 release. A subsequent upgrade to 19.3.6 failed to remediate the vulnerability because the fix required patching Ruby. While GitLab bundled Ruby with its official packages, Alpine's custom container image did not include it.
Attack Execution and Investigation Findings
Between October 20 and 21, malicious CI configurations targeting the vulnerability were submitted by the attacker, resulting in eight worker crashes. Out of those crashes, four were partially successful, though none appeared to fully execute malicious commands. Further investigation revealed that the attackers downloaded the Alpine GitLab container image, signaling potential preparation for a supply-chain attack.
Although Alpine Linux found no conclusive proof that attackers executed code or altered software packages, missing logs and absent outbound connection records meant a compromise could not be entirely ruled out. Additional context regarding these incidents has been thoroughly documented by Bill Toulas.
Rebuilding From Scratch
Faced with missing forensic evidence needed to confirm or deny code execution, the development team elected to take a stringent approach. Comprehensive details and official statements regarding the response are outlined as explained the Alpine Linux team.
An audit conducted up to October 27 verified that repository commits, packages, and releases remained untampered. Furthermore, critical signing keys were safe because they are not stored on the GitLab server. However, if the exploit had succeeded completely, attackers could have accessed user details, password hashes, 2FA secrets, CI/CD secrets, integration credentials, and private project contents.
Recommendations and Ongoing Threat Landscape
To secure deployments moving forward, Alpine advises users to reset their GitLab passwords and pull the updated alpinelinux/gitlab:19.3.6 image released on October 27, which incorporates Ruby 3.3.13 to resolve CVE-2026-97229.
The broader security community continues to monitor severe infrastructure threats. Recent reports indicate that CISA says max severity GitLab flaw now exploited in the wild, highlighting the urgent need for timely patching across enterprise and open-source ecosystems alike.
Sources
- BleepingComputerAlpine Linux rebuilds GitLab after attempted RCE attack
Continue chronologically
Related stories
Max-Severity GitLab Flaw Exploited Against Alpine Linux
A max-severity code execution vulnerability in GitLab was targeted in an attack against Alpine Linux's instance just one week after disclosure.
CISA Confirms Active Exploitation of Maximum-Severity GitLab Flaw
CISA confirms active exploitation of a maximum-severity GitLab vulnerability tracked as CVE-2026-97229 and urges administrators to apply patches immediately.
GitLab Warns of Max Severity Code Execution Flaw
GitLab has released urgent security patches for a maximum-severity integer overflow vulnerability in its Regular Expression Compiler engine.
Ivanti Patches Two Zero-Days in Connect Secure Attack Chain
Ivanti has issued security updates for two additional Connect Secure zero-days that attackers chained with a previously disclosed VPN vulnerability.
