Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open

Alpine Linux disclosed that an attacker attempted to exploit its own GitLab instance using CVE-2026-97229, a maximum-severity (CVSS 10.0) flaw that allows code execution through a malicious regular expression in CI/CD configuration files. Although GitLab had shipped a fix a week earlier, Alpine's server remained vulnerable because the official GitLab upgrade only patches the Ruby bundled inside GitLab's own packages and container images — the underlying bug actually lives in Ruby's Onigmo regex engine, so installations running standard Ruby, like Alpine's, stayed exposed until Ruby itself was updated to version 3.3.13, 3.4.12, 4.0.9 or later. A newly created account repeatedly probed the server between 20 and 26 October, crashing worker processes and pulling down Alpine's container image, seemingly to fine-tune the attack; Alpine found no confirmed evidence of successful code execution but, since key logs were missing, chose to rebuild the server entirely, rotate secrets, and force a password reset for all accounts. Alpine stresses that upgrading GitLab alone is not sufficient for self-compiled or custom-Ruby deployments, and administrators must separately patch Ruby to close the hole.