Alpine Linux Rebuilds GitLab Instance Following Critical RCE Vulnerability Exploitation Attempts

Alpine Linux has undertaken a complete rebuild of its GitLab instance and a full password reset for all users after detecting multiple attempts to exploit a critical remote code execution (RCE) vulnerability, CVE-2026-97229. The vulnerability, which carries a CVSS score of 10.0, resides in GitLab's handling of regular expressions within CI/CD configurations, specifically an integer overflow flaw in the Onigmo regular expression engine bundled with Ruby. Attackers targeted the unpatched Alpine Linux GitLab instance on October 20 and 21, 2026, a week after GitLab had released fixes on October 12. Although Alpine Linux found no conclusive evidence of successful code execution, the repeated crashes of GitLab worker processes and the attacker's attempt to download the Alpine Linux container image prompted the drastic recovery measures. This incident underscores the critical importance of timely patching and proactive security measures for any organization operating self-managed CI/CD platforms. For DevOps and security teams, the implications are significant. A successful exploitation of such a vulnerability could lead to unauthorized access, data exfiltration, or the injection of malicious code into software supply chains, impacting downstream users and customers. The fact that the attacker downloaded the container image suggests an effort to understand the environment and potentially craft a highly specific and effective exploit, highlighting the increasing sophistication of attacks targeting containerized environments. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog, urging federal agencies to apply fixes immediately. This event fits into a broader trend of increasing attacks on software supply chains and the critical infrastructure of cloud-native development. As containerization and CI/CD pipelines become ubiquitous, they also become more attractive targets for malicious actors. Recent years have seen a rise in vulnerabilities affecting core components of the container ecosystem, such as runc and BuildKit, and ongoing efforts to secure container registries and images. The emphasis on immutable infrastructure and secure-by-default configurations, as seen in developments like Azure Container Linux, aims to mitigate these risks by reducing attack surfaces and simplifying security management. However, as this incident demonstrates, even with advancements in container security, the human element of patching and vigilance remains paramount. In practice, practitioners should treat critical security advisories with extreme urgency. For self-managed GitLab users, this means not only applying patches promptly but also implementing robust monitoring for any unusual activity within their CI/CD pipelines and container registries. Regularly auditing container images for known vulnerabilities and ensuring that all components, including bundled dependencies like Ruby's Onigmo, are up-to-date is crucial. Furthermore, organizations should consider adopting a defense-in-depth strategy, including network segmentation, least-privilege access controls, and immutable infrastructure principles, to limit the blast radius of any potential compromise. The Alpine Linux incident serves as a potent reminder that the security of the software supply chain is a shared responsibility, and proactive measures are essential to protect against evolving threats.