Alpine Linux Rebuilds GitLab After Failed RCE Attempts

Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20 and 21. The attacks targeted CVE-2026-97229, a maximum-severity remote code execution flaw. The vulnerability repeatedly crashed GitLab processes, with some attempts coming close to succeeding. Alpine Linux rebuilt its GitLab server and reset all passwords due to concerns of a possible compromise.

The Alpine Linux team found no evidence that attackers executed code or tampered with its software packages and releases. However, the team could not rule out a successful compromise due to missing logs and a lack of outbound connection records. The team rebuilt the GitLab instance from scratch because they could not rule out code execution and the evidence needed to confirm it no longer exists.

Alpine Linux is a small, lightweight operating system widely used as the foundation for Docker container images. The GitLab instance hosts development repositories, code reviews, and CI jobs. GitLab disclosed the flaw and made fixes available on October 12. Alpine initially installed GitLab version 19.3.4 instead of the patched version 19.3.5. A later upgrade to GitLab 19.3.6 failed to close the flaw because the fix required a patch to Ruby not included in Alpine's custom container image.