Alpine Linux rebuilds GitLab after attempted RCE attack

Sun, 01 Nov 2026 17:05:59 +0000

Engineer — Act: Any self-hosted GitLab instance should be verified as fully patched against the exploited critical CVE; engineers using Alpine Linux as a base image should flag builds from around Oct 20–21 for review pending Alpine’s confirmation that no source or package tampering occurred.
SOC/IR — Act: Review GitLab server logs for RCE exploitation attempts around Oct 20–21; if Alpine Linux packages feed your build pipeline, treat artifacts from that window as potentially suspect and initiate a precautionary sweep until Alpine issues a clean bill of health.
Leader — Plan: Alpine’s build infrastructure may have been compromised — confirm this quarter whether development teams rely on Alpine base images or packages, and establish a posture for responding to potential supply chain contamination if Alpine confirms a breach.

Gitlab-Rce on CuraSec