Trusence Every claim has a source
Last updated 2 November 2026 Search Türkçe
Security

Alpine Linux rebuilds GitLab server after attempted remote code execution attack

Operators still on unpatched GitLab releases remain exposed, with more than 1,000 internet-facing servers yet to be fixed.

2 November 2026 1 min read

Alpine Linux rebuilt its GitLab server from scratch and reset every password after attackers hit it with exploit attempts on October 20 and 21. The flaw, CVE-2026-97229, is a maximum-severity remote code execution bug in GitLab's CI/CD regular expression handling, and the attempts repeatedly crashed GitLab processes, with a few getting partway to success. Alpine found no tampering with its repositories, packages or releases through October 27, but missing logs and outbound connection records meant it could not rule out code execution, and the attackers had downloaded its GitLab container image, which may point to a supply-chain attack. Separately, Shadowserver is tracking more than 1,000 internet-exposed GitLab servers still unpatched against the flaw, even though GitLab shipped fixes on October 12 and CISA has added it to its Known Exploited Vulnerabilities catalog. Operators running self-managed GitLab should upgrade to a patched release, and Alpine users should reset passwords and pull the rebuilt image.

Why it matters

The case shows that a flaw with a maximum severity rating can be used against a public software project's own infrastructure, and that the logs needed to prove what happened may disappear in the process. Alpine could not rule out code execution, so it rebuilt its server and reset every password. Because attackers also downloaded the GitLab container image, the incident raises the possibility of a supply-chain attack even though no tampering has been found in repositories, packages or releases so far. For anyone running self-managed GitLab, the fixes have been available since October 12, and the gap between release and patching is where the remaining risk sits.

Series GitLab regex compiler flaw

  1. 2 Nov Alpine Linux rebuilds GitLab server after attempted remote code execution attack
  2. 29 Oct Attack on Alpine Linux's GitLab server exposes flaw in Ruby's regex engine
  3. 22 Oct GitLab patches maximum-severity code execution flaw in its regex compiler
The whole series · 3 stories →

Sources · 2

Checked against its sources before publishing · 2 November at 16:08