Alpine Linux rebuilt its GitLab server and reset all passwords after hackers tried to exploit CVE-2026-97229, a maximum-severity remote code execution flaw in GitLab’s CI/CD regular expression compiler Onigmo, on October 20-21. The attackers submitted malicious CI configurations that caused eight worker crashes, with four attempts partially successful, but Alpine found no evidence of code execution or tampering of software packages. The project had initially installed GitLab 19.3.4, later upgraded to 19.3.6, yet the fix required a Ruby patch that Alpine’s custom container image missed. Although no signing keys were stored on the server and no compromise of user details, password hashes, 2FA secrets or CI/CD secrets has been confirmed, Alpine cannot rule out a successful breach because logs are missing. Alpine advises users to reset their GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image released on October 27, which includes Ruby 3.3.13 and addresses CVE-2026-97229. 1