GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux

Alpine Linux says an attacker tried to exploit GitLab's CVE-2026-97229 (CVSS 10.0, a regex bug in Ruby's Onigmo engine) on October 20 and 21, crashing workers eight times. Alpine found no evidence of code execution but rebuilt the instance anyway. Its checks found no tampering with packages or releases. The lesson for self-hosters: GitLab's fix is a Ruby patch applied only in official packages, so custom images need Ruby 3.3.13, 3.4.12 or 4.0.9 as well. Most figures come from Alpine alone.