The attacks targeted CVE-2026-97229, a maximum-severity remote code execution flaw, repeatedly crashing GitLab processes, with some attempts coming close to succeeding. Although Alpine Linux found no evidence that attackers executed code or tampered with its software packages and releases, it could not rule out a successful compromise due to missing logs and a lack of outbound connection records.
"Because we cannot rule out code execution, and the evidence we would need to confirm it no longer exists, we took the harder route and rebuilt the GitLab instance from scratch," explained the Alpine Linux team. Alpine Linux is a small, lightweight operating system widely used as the foundation for Docker container images that run applications and services.
Their GitLab instance hosts development repositories, code reviews, and CI jobs, including the "aports" build recipes used to produce Alpine's software packages. That makes it a valuable supply chain target, as tampering with their GitLab environment could affect downstream software.
