Alpine Linux recently rebuilt its GitLab infrastructure and mandated a password reset for all users after detecting targeted exploitation attempts against a critical remote code execution vulnerability, following insights from Bleeping Computer.
The attacks occurred between Oct. 20 and Oct. 21, targeting CVE-2026-97229, a maximum-severity integer overflow flaw in the Onigmo regular expression compiler. Attackers submitted malicious CI/CD configurations that caused eight worker crashes, with four attempts showing signs of partial success. While Alpine Linux found no definitive evidence of unauthorized code execution or software tampering, the organization opted to rebuild its GitLab instance from scratch due to missing logs and insufficient connection records.
The incident highlights significant supply chain risks, as Alpine Linux serves as a foundational component for numerous Docker container images. Although the project confirmed that signing keys were not stored on the server, a successful compromise could have exposed user credentials, CI/CD secrets, and private project data. Alpine Linux has since updated its GitLab container image to version 19.3.6, which includes the necessary Ruby patches to remediate the vulnerability. Users are strongly advised to update their systems and reset all associated passwords to ensure continued security.
Source: Bleeping Computer
