Alpine Linux Rebuilds gitlab.alpinelinux.org After CVE-2026-97229 Regex Probes

The attack followed Alpine's erroneous 13 October upgrade to GitLab 19.3.4 rather than the patched 19.3.5. The attacker downloaded the alpinelinux/gitlab container image and submitted malicious CI configurations that crashed workers and produced 502 errors. Alpine detected the ongoing vulnerability only on 26 October, after its 22 October move to 19.3.6 failed to address the flaw because the instance used standard Ruby instead of GitLab's bundled version.

Evidence consists of crash logs showing four partial exploit sequences, absent outbound connection records from the hosting provider, and missing background job logs. No timing delays, unexpected files, or data exfiltration were observed. Alpine acknowledged that a successful exploit would leave no crash or web-log trace, prompting the decision to treat the server as potentially compromised.

The incident exposes the supply-chain risk to Alpine's aports repository and the broader problem of self-managed GitLab deployments that skip Ruby updates. Official statements note no code execution, yet the absence of logging on critical paths leaves the outcome unverifiable. Extended package-release validation through 27 October and mandatory Ruby 3.3.13+ upgrades for users of Alpine's image follow directly from the event.

Alpine will reopen the server to developers only after testing the rebuilt instance with updated Ruby and new secret keys.