Alpine Linux rebuilt its GitLab server from scratch after detecting probes exploiting CVE-2026-97229, a code execution flaw involving CI configurations.
The incident highlights complications when standard Ruby environments diverge from bundled application packages during updates.
How the attempted breach occurred
The issue concerns a security flaw in the popular code management platform GitLab, which could allow someone to remotely execute code on the computer. The Alpine Linux team had installed an update on October 22, but that move did not fix the problem because the computer was using a standard version of the Ruby programming language instead of the packages typically included with the platform.
According to the information released, a newly created account conducted tests on October 20 and 21, sending specially configured settings that caused errors and interruptions in processes. Officials also found that the attacker downloaded a copy of the software used by the computer, which indicates that he was likely customizing the attack tools.
After blocking the suspicious account on October 23 and seeing new access attempts in the following days, officials closed access to everyone except core developers on October 27, beginning a complete rebuild of the system from scratch.
The state of the data and next steps
The process was completed on October 28, with the replacement of the digital security keys and the use of a patched version of Ruby. The team found no evidence that the attack was successful, but because a successful intrusion may leave no trace, the computer was treated as if it had been compromised.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Hackers hit Cisco systems to steal encryption keys
↗
If the attack had been successful, it could have exposed user credentials, passwords, digital keys, and private code repositories. However, it has been confirmed that the packages built and released between October 20 and 24 are from verified developer changes and have not been tampered with.
When the service reopens, users will need to set a new password via the corresponding recovery page.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)