Alpine Linux Rebuilds GitLab After Critical Vulnerability Attack

On October 20-21, 2026, hackers attempted to exploit a critical vulnerability (CVE-2026-97229) in GitLab's infrastructure used by Alpine Linux. This vulnerability allows unauthenticated attackers to execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. Although Alpine Linux found no evidence that the attackers successfully executed code, the lack of logs and outbound connection records meant they could not rule out a successful compromise. To ensure security, the Alpine Linux team decided to rebuild the GitLab instance from scratch and reset all passwords. The existence of this vulnerability makes Alpine Linux's GitLab environment a significant target for supply chain attacks, potentially affecting downstream software security. Notably, after upgrading to GitLab version 19.3.6, Alpine Linux still could not fully patch the vulnerability because it originated from Ruby's regular expression engine, Onigmo, and Alpine's custom container image did not include the necessary Ruby patches.