Alpine Linux rebuilds GitLab server after hack
The attacker may have exploited a critical Ruby flaw, but no tampered packages were found.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Alpine Linux has completely rebuilt its GitLab server after an attacker attempted to exploit a critical vulnerability in October. The open-source project found no evidence that the attack succeeded, but cannot rule this out entirely because some log data is missing.
The attack took place on 20 and 21 October, according to Alpine. A newly created account sent modified CI configurations to the server, causing processes to crash eight times. In four cases, the attacker got partway through the exploit, according to Alpine, but the next step failed.
The vulnerability is registered as CVE-2026-97229 and, according to GitLab’s assessment, has a maximum severity score of 10.0. The flaw lies in how a regular-expression engine in Ruby is used when processing certain GitLab CI configurations. In the worst case, an attacker could execute code on the server.
Alpine updated GitLab on 22 October, but later discovered that the Ruby version in use did not contain the necessary fix. The vulnerability was not only in the GitLab code, but also in the Ruby component Alpine used in its own container.
On 27 October, Alpine closed the GitLab server to everyone except developers and build servers. The server was then rebuilt; passwords and secret keys were replaced. The project is testing the infrastructure before making it fully public again.
Alpine says it found no indications that the attacker executed code, took private data or obtained signing keys. Packages and releases from the period concerned also reportedly match verified source code outside GitLab. At the same time, some log files are missing and outgoing network traffic was not recorded.
The incident is primarily relevant to organisations that manage GitLab themselves. According to Alpine, simply updating GitLab is not always enough when an installation uses its own Ruby version or container. Administrators must also check that the Ruby patch and the correct container release have been installed.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The technical timeline and the uncertainty about whether the exploit succeeded are taken directly from Alpine’s incident report and confirmed by an independent security publication. The text distinguishes proven tampering from risks that could not be fully ruled out.
- confirmed Alpine Linux rebuilt its GitLab server after an attempted attack. — Reported in Alpine Linux’s official incident report. source
- confirmed CVE-2026-97229 has a severity score of 10.0. — The score is mentioned in Alpine’s report and in independent security reporting. source
- confirmed No evidence was found that packages or releases had been tampered with. — Alpine describes checks against external source-code and build records. source
Editor's note
The attack, the rebuild and the uncertainty about possible code execution are based on Alpine’s incident report. Independent reporting confirms the main points; there is no evidence that Alpine packages were tampered with.Sources
More on this in Dutch media
- NU.nl — „alpine linux”
- De Telegraaf — „alpine linux”
- de Volkskrant — „alpine linux”