Alpine Linux Rebuilds GitLab After Exploit Attempts Expose Unpatched Ruby Runtime
Active Exploitation · 22 sources · Updated 54m ago · First seen Oct 28, 2026
Alpine Linux reported attempted exploitation of CVE-2026-97229, a CVSS 10.0 GitLab remote-code-execution vulnerability, against gitlab.alpinelinux.org on October 20–21. The flaw affects CI configuration regular-expression evaluation through Ruby’s Onigmo engine. Although Alpine upgraded to GitLab 19.3.6, its custom container remained vulnerable because it used separately installed Ruby without the required patch rather than GitLab’s patched bundled runtime. Investigators found no evidence of successful code execution, but unavailable forensic evidence prevented them from ruling out compromise.
Alpine rebuilt the server, reset all passwords, replaced GitLab secret keys, and deployed patched Ruby. Integrity checks found no tampering in examined aports commits, packages, or October 21 releases; comparisons with independent repository records verified source changes used for packages built October 20–24, while verification through October 27 remained underway. Administrators using separately installed Ruby must update both GitLab and Ruby; Alpine container users must repull the corrected GitLab 19.3.6 image published October 27.
