Alpine Linux rebuilt its GitLab server and reset all passwords after hackers attempted to exploit a critical vulnerability in its development infrastructure on October 20-21. The attacks targeted CVE-2026-97229, a maximum-severity remote code execution flaw in GitLab’s CI/CD regular expression compiler. While Alpine Linux found no evidence of successful code execution or tampering with software packages through October 27, the organization could not completely rule out a compromise due to missing logs and unavailable outbound connection records.
Alpine Linux’s GitLab instance hosts development repositories and build recipes used to create the project’s software packages, making it an attractive supply chain target. The vulnerability was disclosed on October 12, but Alpine initially installed an unpatched GitLab version and later encountered a configuration issue where the necessary Ruby patch was not included in its custom container image. The attackers submitted malicious CI configurations causing eight worker crashes, and evidence showed they downloaded Alpine’s GitLab container image. Alpine has advised users to reset passwords and pull the updated container image published October 27, which includes the necessary security patch.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
