Attackers targeted the Alpine Linux GitLab instance across October 20 and 21 using a critical flaw in the Onigmo regular expression engine. Although an initial upgrade to GitLab 19.3.6 failed to remediate the crashes because standard system Ruby was in use, the underlying container image has now been patched with Ruby 3.3.13. Post-incident analysis found no signs of private data access or successful code execution, but the infrastructure was still treated as compromised and reconstructed on October 28. Platform maintainers are conducting final testing while warning members to cycle identical credentials used on other websites due to automated credential-stuffing traffic.
Key points
Infrastructure maintainers rebuilt the GitLab server from scratch and replaced all intern…: Infrastructure maintainers rebuilt the GitLab server from scratch and replaced all internal secret keys as a protective measure.
Forensic investigations confirmed that Alpine releases, packages, and the aports reposito…: Forensic investigations confirmed that Alpine releases, packages, and the aports repository suffered no tampering during the incident.
Users must reset their account credentials through the recovery process and change any ma…: Users must reset their account credentials through the recovery process and change any matching passwords used across external platforms.
Sources checked by our analysis pipeline: 1
On October 20 and 21, an attacker tried to exploit a GitLab vulnerability (CVE-2026-97229) on our instance, a week after the fix was released. The attack came close to working. We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with.
GitLab is being tested before we open it to the public again. All passwords have been reset, so when it is back you will need to set a new one with “Forgot your password?” on the sign-in page. We will post exactly what you need to do when it reopens. In the meantime: if you used the same password for your gitlab.alpinelinux.org account anywhere else, change it there. We have seen automated login attempts against our GitLab with passwords leaked from other sites.
If you have questions or concerns please reach out to us at infra@alpinelinux.org.
What happened
The vulnerability: CVE-2026-97229 is a critical (CVSS 10.0) vulnerability…
The tech giant's gaming and personal computing divisions experienced widespread financial downturns during the opening quarter of its 2027 fiscal year. These pullbacks across multiple consumer-facing product categories highlight challenges in both device sales and digital gaming offerings.
An entity calling itself the Department of Peace published sensitive personnel files to limit what it characterized as harm caused by federal agencies. The incident marks the third significant breach of United States government records reported within the past month. The exposure poses acute operational risks by detailing private contact records alongside undercover, surveillance, and special operations assignments.
Researchers and computer scientists now have access to a specialized archive containing tens of thousands of academic abstracts spanning several decades. The curated repository enables precise querying to help users track foundational literature and investigate specific computational theories without manual filtering across disparate archives.