Alpine Linux rebuilds GitLab infrastructure after RCE attack

Alpine Linux was forced to completely rebuild its GitLab development infrastructure and reset all user passwords after hackers attempted to exploit a critical vulnerability on October 20-21. The open-source operating system, widely used as a lightweight foundation for Docker containers, took swift action despite finding no definitive proof of compromise.

• Hackers targeted CVE-2026-97229, a maximum-severity remote code execution flaw affecting GitLab.
• The development team could not rule out a successful breach due to missing log records and outbound data.
• As a precaution, the entire GitLab instance was rebuilt from scratch and all accounts were reset.

Vulnerability Details and Attack Vector The attacks exploited CVE-2026-97229, an integer overflow vulnerability residing in GitLab's Onigmo regular expression compiler bundled with Ruby. This flaw allows unauthenticated attackers to execute arbitrary code on the affected server by submitting malicious CI/CD pipeline configurations. GitLab disclosed the issue and released patches on October 12. However, Alpine's infrastructure was running vulnerable versions and subsequent updates failed to completely close the gap because the fix required a Ruby patch that was missing from Alpine's custom container image. On October 20 and 21, attackers submitted malicious CI payloads, triggering several worker crashes and successfully executing partial pipeline tasks.

Investigation Results and Supply Chain Risks An internal investigation confirmed that no repository commits, software packages, or releases up to October 27 had been tampered with. Furthermore, cryptographic signing keys were safe because they are not stored on the GitLab server. Nonetheless, had the exploit fully succeeded, sensitive information such as password hashes, user credentials, and CI/CD secrets could have been exposed. Investigators also noted that the attackers downloaded Alpine's GitLab container image, indicating preparations for a potential software supply chain attack. Because necessary auditing logs were missing to fully guarantee integrity, the project chose the most secure path of a complete rebuild.

Recommendations and Mitigation Steps Alpine Linux has advised all users and contributors to reset their GitLab passwords immediately. Additionally, the project released an updated container image, alpinelinux/gitlab:19.3.6, which includes Ruby 3.3.13 to permanently address CVE-2026-97229. This security incident serves as a crucial reminder for development teams regarding the necessity of prompt vulnerability patch management, particularly for core software supply chain components used heavily across modern containerized environments.