Hackers launched a series of sophisticated attacks against **Alpine Linux**'s development infrastructure between October 20-21, targeting a maximum-severity remote code execution flaw in **GitLab**, identified as **CVE-2026-97229**. These attempts repeatedly crashed **GitLab** processes, with some coming perilously close to full exploitation. ### The Vulnerability and Missed Patches **CVE-2026-97229** is an integer overflow vulnerability found within **GitLab**'s CI/CD regular expression compiler, **Onigmo**, which is bundled with **Ruby**. This flaw could allow unauthenticated attackers to execute arbitrary code on the server by submitting a specially crafted regular expression in a CI/CD pipeline configuration. **GitLab** disclosed the vulnerability and released fixes on October 12. However, **Alpine Linux** initially installed **GitLab** 19.3.4 instead of the patched 19.3.5. A subsequent upgrade to 19.3.6 also failed to remediate the issue because the fix required a **Ruby** patch, which was bundled in official **GitLab** packages but not included in **Alpine**’s custom container image. ### Attack Details and Supply Chain Concerns The attackers exploited this window of vulnerability, submitting malicious CI configurations that led to eight worker crashes. Four of these attempts were partially successful, though none appeared to achieve full code execution. Of particular concern, the **Alpine Linux** team observed that attackers downloaded their **GitLab** container image, suggesting a potential reconnaissance phase for a broader supply-chain attack. **Alpine Linux** is a lightweight operating system extensively used as a base for **Docker** container images, making its development environment a high-value target for compromising downstream software.  ### Incident Response and Rebuilding Despite an extensive investigation, **Alpine Linux** found no evidence of code execution, tampering with repository commits, software packages, or releases up to October 27. Critically, signing keys, which are not stored on the **GitLab** server, were not exposed. However, due to missing logs and a lack of outbound connection records, the team could not definitively rule out a successful compromise. This uncertainty prompted the decision to rebuild the entire **GitLab** instance from scratch, a proactive measure to ensure the integrity of their development environment. "Because we cannot rule out code execution, and the evidence we would need to confirm it no longer exists, we took the harder route and rebuilt the **GitLab** instance from scratch," explained the **Alpine Linux** team in their official announcement.  ### User Actions and Mitigations While no compromise of user data has been confirmed, potentially exposed information could include user details, password hashes, 2FA secrets, CI/CD secrets, integration credentials, and private project content. As a precautionary measure, **Alpine Linux** advises all users to reset their **GitLab** passwords. Additionally, users are urged to pull the `alpinelinux/gitlab:19.3.6` image published on October 27, which includes **Ruby** 3.3.13 and fully addresses **CVE-2026-97229**.