Attackers aimed the GitLab bug at Alpine Linux. A GitLab update alone wasn't enough.

SecurityWeek reports Alpine Linux says an attacker targeted its GitLab on 20 and 21 October using CVE-2026-97229, CVSS 10. The attempt failed and Alpine found no evidence of code execution, but it rebuilt the instance and reset all passwords. The flaw remained after Alpine updated to GitLab 19.3.6, because it sits in Ruby.

The attacker got partway through the exploit four times and pulled Alpine's container image, which suggests tuning to that build. Alpine says its packages and 21 October releases were not tampered with.

If you run GitLab on a Ruby you manage yourself, upgrade Ruby to 3.3.13, 3.4.12, 4.0.9 or later as well as GitLab, as Alpine recommends.