GitLab Security Incident: Attempted Exploitation of CVE-2026-97229

On October 20-21, attackers attempted to exploit a critical GitLab vulnerability (CVE-2026-97229) on Alpine Linux's instance, causing eight worker process crashes but with no confirmed successful code execution. Alpine Linux treated the system as compromised and rebuilt it from scratch; all user passwords have been reset and the aports repository and packages were confirmed not to have been tampered with. The vulnerability stems from a flaw in Ruby's regular expression engine and required patching Ruby itself, not just updating GitLab, which is why Alpine's GitLab instance remained vulnerable even after upgrading to version 19.3.6.