Security · Updated 29 Oct, 05:15 am IST
Alpine Linux GitLab instance hit by attempted CVE-2026-97229 exploit
Why it matters for readers: It’s an example of how attackers target widely used developer tools and why patches and password hygiene are important.
- An attacker attempted to exploit CVE-2026-97229 against gitlab.alpinelinux.org on October 20–21, shortly after a fix was released.1
- Alpine treated the instance as compromised and rebuilt it from scratch because the attack came close to working, though they found no proof it succeeded.1
- Checks show the aports repository, packages, and the October 21 releases were not tampered with.1
- All passwords have been reset and users will need to use “Forgot your password?” when the GitLab instance reopens; users should change reused passwords elsewhere.1
- The vulnerability stems from how GitLab evaluates regex in CI (Onigmo in Ruby); GitLab published fixes on October 12 and upstream Ruby shipped fixes on October 23.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started