Xakerlar 20–21-oktabr kunlari Alpine Linux'ning rivojlantirish infratuzilmasida muhim GitLab zaifligidan foydalanishga urinishdi, bu esa ochiq manbali loyihani GitLab serverini qayta qurishga va mumkin bo'lgan buzilish xavotiri tufayli barcha parollarni qayta o'rnatishga majbur qildi.
Hujumlar maksimal darajadagi masofadan kod bajarish (RCE) zaifligi bo'lgan CVE-2026-97229 ni nishonga oldi, GitLab jarayonlarini qayta-qayta ishdan chiqarib, ba'zi urinishlar muvaffaqiyatga yaqinlashdi.
Alpine Linux hujumchilar kodni bajargan yoki dasturiy paketlar va relizlarga aralashganiga dalil topmagan bo'lsa-da, yo'qolgan loglar va tashqi ulanish yozuvlarining yo'qligi tufayli muvaffaqiyatli buzilishni inkor eta olmadi.
"Kod bajarilishini inkor eta olmaganimiz va buni tasdiqlash uchun zarur dalillar endi mavjud emasligi sababli, biz qiyinroq yo'lni tanladik va GitLab nusxasini noldan qayta qurdik", — deb tushuntirdi Alpine Linux jamoasi.
Alpine Linux — ilovalar va xizmatlarni ishga tushiradigan Docker konteyner tasvirlari uchun asos sifatida keng qo'llaniladigan kichik, yengil operatsion tizim.
Ularning GitLab nusxasi rivojlantirish omborlari, kod tekshiruvlari va CI ishlarini, jumladan Alpine'ning dasturiy paketlarini ishlab chiqarish uchun ishlatiladigan "aports" qurilish retseptlarini o'z ichiga oladi.
Bu uni ta'minot zanjiri uchun qimmatli nishonga aylantiradi, chunki ularning GitLab muhitiga aralashish quyi oqim dasturiy ta'minotiga ta'sir qilishi mumkin.
CVE-2026-97229 — GitLab'ning CI/CD muntazam ifoda kompilyatori Onigmo'dagi maksimal darajadagi butun son to'lib ketishi zaifligi bo'lib, u Ruby'da jamlangan va autentifikatsiyasiz hujumchilarga serverda ixtiyoriy kodni bajarishga imkon berishi mumkin.
GitLab 12-oktabrda zaiflikni oshkor qildi va tuzatishlarni taqdim etdi, hujumchilar CI/CD quvur konfiguratsiyasida maxsus tayyorlangan muntazam ifodani yuborish orqali ma'lum sharoitlarda uni ishga tushirishi mumkinligi haqida ogohlantirdi.
Alpine dastlab tuzatilgan 19.3.5 versiyasi o'rniga GitLab 19.3.4 ni o'rnatdi. Keyinchalik 19.3.6 ga yangilash ham zaiflikni yopmadi, chunki tuzatish Ruby'ga patch talab qilar edi, GitLab rasmiy paketlari bilan jamlangan, ammo Alpine'ning maxsus konteyner tasviri uni o'z ichiga olmagan.
20–21-oktabr kunlari hujumchi zaiflikni nishonga olgan zararli CI konfiguratsiyalarini yubordi, natijada sakkizta ishchi ishdan chiqdi; to'rttasi qisman muvaffaqiyatli bo'ldi, ammo hech biri to'liq muvaffaqiyatga erishmadi.
Alpine Linux jamoasi hujumchilar uning GitLab konteyner tasvirini yuklab olganini aniqladi, bu ularning ta'minot zanjiri hujumiga tayyorgarlik ko'rayotgan bo'lishi mumkinligini ko'rsatadi.
Tekshiruvdan so'ng, Alpine 27-oktabrgacha ombor commitlari, paketlar yoki relizlarda hech qanday aralashuv topmadi. Shuningdek, imzo kalitlari fosh bo'lishi mumkin emas, chunki ular GitLab serverida saqlanmaydi.
Hodisa xronologiyasi Manba: Alpine Linux
Agar ekspluatatsiya muvaffaqiyatli bo'lgan bo'lsa, ehtimol fosh bo'lgan ma'lumotlar foydalanuvchi ma'lumotlari, parol xeshlari, 2FA sirlari, CI/CD sirlari, integratsiya ma'lumotlari va shaxsiy loyiha mazmunini o'z ichiga oladi, ammo yuqoridagilarning hech biri buzilganligi tasdiqlanmagan.
Alpine foydalanuvchilarga GitLab parollarini qayta o'rnatishni va 27-oktabrda e'lon qilingan Ruby 3.3.13 ni o'z ichiga olgan va CVE-2026-97229 ni bartaraf etadigan alpinelinux/gitlab:19.3.6 tasvirini yuklab olishni tavsiya qiladi.
Mavjud himoyalaringiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security'ning AI agentlari elektron pochta niyati, konteksti va xatti-harakatlarini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace'ning 14 kunlik faqat o'qish skaneri bilan MX o'zgarishlarsiz nima o'tib ketayotganini ko'ring.
Bepul elektron pochta xavfsizligi skaneringizni boshlang.
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20–21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.
The attacks targeted CVE-2026-97229, a maximum-severity remote code execution flaw, repeatedly crashing GitLab processes, with some attempts coming close to succeeding.
Although Alpine Linux found no evidence that attackers executed code or tampered with its software packages and releases, it could not rule out a successful compromise due to missing logs and a lack of outbound connection records.
"Because we cannot rule out code execution, and the evidence we would need to confirm it no longer exists, we took the harder route and rebuilt the GitLab instance from scratch," explained the Alpine Linux team.
Alpine Linux is a small, lightweight operating system widely used as the foundation for Docker container images that run applications and services.
Their GitLab instance hosts development repositories, code reviews, and CI jobs, including the "aports" build recipes used to produce Alpine’s software packages.
That makes it a valuable supply chain target, as tampering with their GitLab environment could affect downstream software.
CVE-2026-97229 is a maximum-severity integer overflow vulnerability in GitLab’s CI/CD regular expression compiler Onigmo, bundled in Ruby, that could allow unauthenticated attackers to execute arbitrary code on the server.
GitLab disclosed the flaw and made fixes available on October 12, warning that attackers can trigger it under certain conditions by submitting a specially crafted regular expression in a CI/CD pipeline configuration.
Alpine initially installed GitLab 19.3.4 instead of the patched version, 19.3.5. A later upgrade to 19.3.6 also failed to close the flaw because the fix required a patch to Ruby, which GitLab bundled with its official packages but Alpine’s custom container image did not include.
On October 20-21, the attacker submitted malicious CI configurations targeting the flaw, causing eight worker crashes; four were partially successful, though none seemed to go all the way.
The Alpine Linux team found that the attackers downloaded its GitLab container image, suggesting they may have been preparing a supply-chain attack.
After investigating, Alpine found no tampering in the repository commits, packages, or releases up to October 27. Also, no signing keys could have been exposed, as those aren’t stored on the GitLab server.
Incident timeline Source: Alpine Linux
If exploitation succeeded, potentially exposed information includes user details, password hashes, 2FA secrets, CI/CD secrets, integration credentials, and private project content, though no compromise of the above has been confirmed.
Alpine advises users to reset their GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image published on October 27, which contains Ruby 3.3.13 and addresses CVE-2026-97229.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.