Overview
- An attacker registered an account and used crafted CI configurations to target CVE-2026-97229, a critical regular-expression flaw in Ruby’s Onigmo engine, causing eight GitLab worker crashes and four near-successful exploit attempts.
- The underlying fix for the flaw was a patch to Ruby rather than to GitLab source, so Alpine’s early upgrade did not protect its self-built image until it republished alpinelinux/gitlab:19.3.6 with Ruby 3.3.13 on October 27.
- Because key background-job logs and the old container filesystem were missing, Alpine treated the instance as potentially compromised, rebuilt GitLab from scratch by October 28, and replaced all passwords and secret keys.
- Alpine verified aports commits and packages built during the incident window and found no signs of tampering, but the absence of outbound-connection logs prevents a definitive forensic conclusion.
- The project has closed public logins while testing, republished fixed images, and pledged faster critical patching, longer log retention, outbound logging, signed release tags, and guidance for users to reset passwords and rotate any reused credentials.