Alpine Linux rebuilds GitLab infrastructure after severe exploit attempt

Hackers attempted to exploit a critical remote code execution vulnerability in the development infrastructure of Alpine Linux on October 20 and October 21, BleepingComputer reported. The malicious activity prompted the open-source project to rebuild its GitLab server completely and reset all user passwords due to concerns about potential system compromise. [1]

The attacks targeted a maximum-severity security flaw tracked as CVE-2026-97229, which carries a maximum CVSS score of 10.0, according to BleepingComputer and earlier reporting by FTMQ Security. BleepingComputer reported that repeated exploit attempts caused GitLab processes to crash. As FTMQ Security reported earlier, the Cybersecurity and Infrastructure Security Agency added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog after SecurityWeek observed attacks directed at Alpine Linux. GitLab released security patches for affected software versions on October 12, 2026. [1][6]

Alpine Linux is a security-focused Linux distribution that uses musl, BusyBox, and OpenRC. Binaries in Alpine Linux are compiled as position-independent executables with stack-smashing protection, and the lightweight operating system is widely deployed inside containers, virtual machines, and embedded network hardware. [2]