Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

A maximum-severity flaw in GitLab, CVE-2026-97229 (CVSS 10/10), was weaponized just a week after its disclosure in an attempted attack against Alpine Linux's own GitLab server. The bug lies in Onigmo, Ruby's regex engine, and could let an unauthenticated attacker run arbitrary code by submitting a malicious regular expression inside a CI/CD configuration. Alpine Linux says an attacker used a freshly created account on October 20-21 to send rigged CI configs that repeatedly crashed the worker process and even pulled Alpine's GitLab container image, apparently to fine-tune the exploit, though no proof of successful code execution was found. As a precaution Alpine rebuilt its instance, reset all passwords, and confirmed its package repository and recent releases remain untampered, while warning that because the flaw lives in Ruby itself rather than GitLab's code, teams running GitLab with custom Ruby builds must also upgrade to Ruby 3.3.13, 3.4.12, or 4.0.9 or later even after patching GitLab to 19.3.6. CISA has since added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog, giving federal agencies just three days to remediate under BOD 26-04.