Alpine Linux

but this is a bit of a transparency story and a positive story I wanna tease out here.

This is from Alpine Linux.

The article is GitLab Security Incident, Attempted Exploitation of CVE-2026-97229.

Now, I'm never going to quiz you or anybody else on what is a particular CVE number.

I gave up on that long ago.

It kind of doesn't matter.

But the reason this caught my eye is that it's from AlpineLinux.org, and they're saying that there was a flaw in how GitLab evaluates regexes that could lead to an RCE, essentially.

And what they noted was that, ah, we observed an attack, but it looks like the attack did not succeed.

But this is a bit of a transparency story and a positive story I want to tease out here.

This is from Alpine Linux.

The article is GitLab Security Incident, Attempted Exploitation of CVE-2026-97229.

I'm never going to quiz you or anybody else on what is a particular CVE number.

I gave up on that long ago.

It kind of doesn't matter.

But the reason this caught my eye is that it's from AlpineLinux.org, and they're saying that there was a flaw in how GitLab evaluates regexes that could lead to an RCE, essentially.

And what they noted was that, ah, we observed an attack, but it looks like the attack did not succeed.

But this is a bit of a transparency story and a positive story I want to tease out here.

This is from Alpine Linux.

The article is GitLab Security Incident, Attempted Exploitation of CVE-2026-97229.

I'm never going to quiz you or anybody else on what is a particular CVE number.

This was a little bit of, we almost lost is sort of how this article could be headlined, but luckily we didn't.

And perhaps that luck came a little bit of the exploitation capabilities of the attacker.

And to be fair to Alpine Linux, a lot of the controls that they have added and put into their network.

So that was a lot of me talking.

CISA drops two more Avanti Connect secure flaws into Kev and the first federal deadline is today.

Attackers went after Alpine Linux's GitLab with a Max Severity CIC debug and a Trojanized Cloud Code extension sat in Cursiver's marketplace for 11 hours planting SSH backdoors.

And of course, if you've been living under a rock, Binance.

More that and more this morning on the CyberHop Podcast.

By the way, if you think I'm wrong, let me know in the comments.

Love a good debate.

Now on a software supply chain where Alpine Linux, the lightweight distro of sitting underneath an enormous share of Docker container images, rebuilt its GitLab server from scratch and reset every password after attackers went after it on October 20th and October 21st.

The target was CVE-2026-907-229, which was a maximum severity integer overflow in Enigmo, the Ruby bundled regex engine used by GitLab's CICD, which lets an unauthenticated attacker run code by submitting a crafted regular expression in a pipeline configuration.

Defenders should expect faster, better-targeted follow-on abuse after an Infostealer infection.

Reported by The Hacker News Alpine Linux rebuilds GitLab after attempted RCE attack.

Attackers tried to exploit the critical GitLab flaw, which CISA says is under active exploitation, against Alpine Linux's development infrastructure.

The project rebuilt its GitLab instance in response.

Anyone running self-hosted GitLab, which sits in the software supply chain, should patch and review for signs of compromise.

This is a textbook case where timely patching and proactive monitoring make all the difference.

Another critical issue involves a max severity vulnerability in GitLab, which is being actively exploited against Alpine Linux environments.

This flaw allows attackers to gain unauthorized access and potentially manipulate CI-CD pipelines or exfiltrate sensitive code.

For organizations using GitLab with Alpine Linux, patching should be a top priority.

But patching alone isn't enough.

Take this opportunity to review your CI-CD security posture.

This is a label that, once read, makes the clerk hand over the keys to the building.

Now, what did Alpine Linux see when it was hit? The project published its own account.

On 20th and 21st October, a newly registered account sent crafted configurations to its GitLab server, which was still running 19.3.4.

The worker processes crashed eight times.