Alpine Linux Rebuilds GitLab Instance After Critical Ruby Vulnerability Attack — Big Tech and the digital economy

Alpine Linux developers are completely rebuilding their GitLab instance following a targeted attack exploiting the critical CVE-2026-97229 vulnerability in Ruby. Although no evidence of code execution or release manipulation was found, missing logs prevent ruling out compromise, prompting a full system reset and password resets for all users.

The development team behind the Alpine Linux distribution has become a target of an attack campaign against vulnerable GitLab instances. While it remains unclear whether the targeted system was successfully compromised, the developers have decided to completely rebuild their GitLab instance from scratch as a security precaution. This incident serves as a warning to other administrators, echoing alerts issued by the US Cybersecurity and Infrastructure Security Agency (CISA) regarding ongoing attacks on GitLab systems.

The attackers exploited CVE-2026-97229, a vulnerability with a maximum CVSS score of 10. This critical flaw allows unauthenticated attackers to execute malicious code by injecting specially crafted regular expressions through CI/CD configurations. The attack against Alpine Linux began on October 20, at which time the affected instance was running GitLab version 19.3.4. Patches for this vulnerability were only included in GitLab versions 19.2.8, 19.3.5, and 19.4.2, which were released on October 12. During the incident, attackers managed to crash GitLab worker processes on the Alpine Linux system.

Although Alpine Linux updated to GitLab version 19.3.6 shortly after observing the attack, this update did not initially resolve the security issue. The root cause of CVE-2026-97229 lies not in GitLab itself, but in Ruby's Onigmo regular expression engine. Consequently, a GitLab update only provides protection if the Ruby version from GitLab's own installation packages is used. Since Alpine Linux developers utilized an independent Ruby installation, the standard update was ineffective, requiring a manual update to Ruby versions 3.3.13, 3.4.12, or 4.0.9.

Following a thorough investigation, the team found no evidence of malicious code execution or manipulation of Alpine Linux releases. However, some logs necessary for the investigation were unavailable, meaning a server compromise cannot be definitively ruled out. As a result, the team chose to rebuild the GitLab instance entirely. Before going live, the new instance will undergo extensive testing. Additionally, all user passwords have been reset, requiring developers to create new credentials upon their next login.

CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog on October 29, warning of active exploitation. Administrators who have not yet patched their GitLab and Ruby installations are urged to do so immediately.

Sources: Golem.de.