Alpine Linux rebuilds GitLab after attempted remote code execution attack
Hackers attempted to exploit maximum-severity vulnerability in CI/CD infrastructure, prompting full server rebuild and password reset
Alpine Linux has rebuilt its GitLab instance from scratch and reset all passwords after hackers attempted to exploit a critical remote code execution vulnerability in the development infrastructure. The attackers targeted CVE-2026-97229, a maximum-severity flaw in GitLab's regular expression compiler, between October 20 and 21, causing multiple process crashes. While the Alpine team found no evidence that attackers successfully executed code or tampered with software packages, missing logs and a lack of outbound connection records mean a compromise cannot be ruled out.