What happened
Alpine Linux disclosed on October 28 that an attacker had attempted to exploit CVE-2026-97229 against its GitLab server on October 20 and 21. The organization said specially crafted CI configurations caused eight worker crashes, including four cases in which the attempt progressed partway through the exploit. It found no evidence of successful code execution or altered release packages, but missing forensic evidence meant it could not rule out a compromise. Alpine rebuilt the server and reset credentials. Its investigation exposed a packaging problem: an upgrade to GitLab 19.3.6 had not supplied the fix because Alpine's container used its own standard Ruby rather than the patched Ruby bundled with official GitLab packages. SecurityWeek independently reported the incident on October 30 and noted that CISA added the vulnerability to its exploited-vulnerabilities catalog on October 29.
Why it matters
The incident illustrates the difference between updating an application version and updating every component that actually implements its security fix. CVE-2026-97229 concerns the regular-expression engine used when processing GitLab CI configurations. Alpine says its particular deployment remained vulnerable even after its GitLab version changed, because the underlying Ruby installation was not patched. That lesson applies most directly to administrators building applications from source or assembling custom containers, not necessarily to customers using the vendor's official packages. Alpine's checks found no tampering with its software releases or signing keys, but the decision to rebuild reflects the limits of incident reconstruction when important logs are absent. A successful exploit was not established by the organization.
What to watch next
Operators of self-managed GitLab should verify how their installation supplies Ruby, review vendor and distribution security guidance, and confirm that the relevant runtime fixes are actually present. Alpine identifies Ruby 3.3.13, 3.4.12 and 4.0.9 or later as patched branches for this issue. Security teams should preserve available evidence and examine unexpected worker crashes or other suspicious activity before assuming that a version-number upgrade resolved exposure. Watch for further incident reports and any additional guidance from GitLab or CISA. Alpine's October 30 update says its GitLab service has reopened, but reopening does not establish that every possible historical impact can be excluded.