Zaifliklar
Alpine Linux'ga qarshi maksimal darajadagi GitLab zaifligi ekspluatatsiya qilindi
CVE-2026-97229 sifatida kuzatilgan xato autentifikatsiyasiz hujumchilarga serverda ixtiyoriy kodni bajarish imkonini beradi.
Muallif
Ionut Arghire
| 30-oktabr, 2026 (ET 5:32)
GitLab'dagi so'nggi kod bajarish zaifligi ochiq e'lon qilinganidan bir hafta o'tib Alpine Linux'ning nusxasiga qarshi muvaffaqiyatsiz hujumda ekspluatatsiya qilindi.
CVE-2026-97229 (CVSS balli 10/10) sifatida kuzatilgan xato Ruby'ning muntazam ifoda dvigateli Onigmo'dagi yetarli bo'lmagan muntazam ifoda tekshiruvidan kelib chiqadi.
"Xato autentifikatsiyasiz foydalanuvchiga CI/CD konfiguratsiyasidagi maxsus tayyorlangan muntazam ifoda orqali GitLab serverida ixtiyoriy kodni bajarish imkonini berishi mumkin edi", deb ta'kidlagan GitLab 12-oktabrdagi maslahatida.
Alpine Linux ma'lumotiga ko'ra, tahdid aktori 20 va 21-oktabr kunlari uning GitLab nusxasiga CVE-2026-97229 ekspluatatsiyasi bilan hujum qildi. Hujum muvaffaqiyatsiz yakunlandi, ammo Linux tarqatmasi nusxani noldan qayta qurdi.
"Bizning tekshiruvlarimiz shuni ko'rsatadiki, aports ombori, paketlar va 21-oktabr relizlari buzilmagan", deb ta'kidlaydi Alpine Linux.
U GitLab nusxasini ommaviy chiqarishdan oldin hali ham sinovdan o'tkazmoqda va barcha parollarni qayta o'rnatgan, boshqa ma'lumotlar buzilishida buzilgan parollar yordamida kuzatilgan avtomatlashtirilgan kirish urinishlari haqida ogohlantirgan.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
20-21-oktabr hujumi doirasida xakerlar yangi ro'yxatdan o'tgan hisobdan foydalanib Alpine Linux'ning GitLab nusxasiga tayyorlangan CI konfiguratsiyalarini yuborishdi va ishchi jarayonni ishdan chiqardi.
"Ushbu 4 ta ishdan chiqishda hujumchi ekspluatatsiyaning bir qismini amalga oshirdi va keyingi qadamda muvaffaqiyatsizlikka uchradi. Hujumchi shuningdek bizning GitLab konteyner tasvirimizni yuklab oldi, bu esa ular ekspluatatsiyani bizning aniq qurilishimizga moslashtirayotganini ko'rsatadi. Biz hujumchi serverda kodni bajarganiga oid hech qanday dalil topmadik, ammo buni inkor eta olmaymiz", deb aytadi Alpine Linux.
Asosiy zaiflik GitLab'da emas, balki Ruby'da joylashganligi va Linux tarqatmasining tasviri standart Ruby'dan foydalanishi sababli, GitLab 19.3.6 ga yangilashdan so'ng zaiflik tuzatilmagan.
"Agar siz GitLab'ni o'z Ruby'ingiz bilan (manbadan yoki o'z konteyner tasviringizda) ishlatsangiz, GitLab paketlari o'rniga, GitLab'ni yangilash yetarli emas: sizga Ruby 3.3.13, 3.4.12, 4.0.9 yoki undan keyingi versiyalar ham kerak", deb ta'kidlaydi Alpine Linux.
Payshanba kuni AQSh kiberxavfsizlik agentligi CISA CVE-2026-97229 ni Ma'lum Ekspluatatsiya Qilingan Zaifliklar (KEV) katalogiga qo'shdi va federal agentliklarga BOD 26-04 talabiga binoan uni uch kun ichida tuzatishni buyurdi.
Bog'liq: TeamViewer xatosi zararli xostlarga qo'llab-quvvatlash texniklarining mashinalarini egallashga imkon berishi mumkin
Bog'liq: Adobe, Veeam, Juniper Networks jiddiy zaifliklarni tuzatdi
Bog'liq: Xitoylik xakerlar past darajadagi ESXi jurnal yozish xatosini nol kun sifatida jimgina ishlatishdi
Bog'liq: Xakerlar yangi Oracle EBS zaifligini tekshirishni boshlashdi
Yozgan
Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Kundalik axborot byulleteni
So'nggi kiberxavfsizlik tahdidlari, tendentsiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Ionut Arghiredan ko'proq
- 41 000 dan ortiq DHS xodimlarining ma'lumotlari onlayn tarzda sizib chiqdi
- HHS arizasi iRhythm ma'lumotlar buzilishi qurbonlari sonini 8,2 million deb ko'rsatdi
- Xitoylik xakerlar past darajadagi ESXi jurnal yozish xatosini nol kun sifatida jimgina ishlatishdi
- Ukraina Hive va Nefilim ransomware sherigi AQSh qamoqxonasida 70 oyga hukm qilindi
- Chrome va Firefox yangilanishlari 200 dan ortiq zaifliklarni tuzatdi
- Xitoy bilan bog'liq xakerlar PHP2Shell'dan foydalanib xavfsizlik devorlarini ildizdan buzishdi
- Xakerlar yangi Oracle EBS zaifligini tekshirishni boshlashdi
- Sotuvchi kalitining sizib chiqishi 238 000 Denver Health Plan a'zolarining ma'lumotlarini xavf ostiga qo'ydi
So'nggi yangiliklar
- TeamViewer xatosi zararli xostlarga qo'llab-quvvatlash texniklarining mashinalarini egallashga imkon berishi mumkin
- 6 milliard dollarlik Binance xakerligi Shimoliy Koreyaning TraderTraitor belgilarini ko'rsatadi
- Xavf shaxsiy bo'lganda: Xavfsizlik rahbarlari saraton tashxisidan nimani o'rganishi mumkin
- Google Gemini 4 Carbon modelida kuchli kiberxavfsizlik imkoniyatlarini ta'kidlaydi
- AQSh saylovlari qanchalik xavfsiz? Ovoz berish mashinalari xavflari va AI tahdidining o'sishi
- Cisco Quarry'ni AI agent hujumlarini yashirin qadamlar ichida ushlash uchun ochiq manbaga aylantirdi
- Adobe, Veeam, Juniper Networks jiddiy zaifliklarni tuzatdi
- BAE bankrotlik sudlari bilan bog'liq hodisada ma'lumotlar chiqarilmaganini aytdi
Trendda
Xitoy bilan bog'liq xakerlar PHP2Shell'dan foydalanib xavfsizlik devorlarini ildizdan buzishdi
Tailscale Rushes Patches After Uncoordinated Disclosure of 'Tailworm' Flaws
Node2Shell: Brotli xatosi Microsoft, Node.js, Python paketlari bo'ylab tuzatishlarni keltirib chiqardi
CISA Node2Shell ekspluatatsiyasidan ogohlantirdi, chunki Honeypots hujum urinishlarini qayd etdi
Chrome va Firefox yangilanishlari 200 dan ortiq zaifliklarni tuzatdi
Xitoylik xakerlar past darajadagi ESXi jurnal yozish xatosini nol kun sifatida jimgina ishlatishdi
Xakerlar yangi Oracle EBS zaifligini tekshirishni boshlashdi
Cisco SD-WAN nol kun ekspluatatsiyasi Volt Typhoon'ning 'Silent Train' tarmog'iga bog'landi
Kundalik axborot byulleteni
So'nggi tahdidlar, tendentsiyalar va texnologiya haqida xabardor bo'lish, shuningdek, soha mutaxassislarining chuqur fikrlarini olish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Vebinar: Kuchliroq CTEM dasturi uchun agentik pentesting
4-noyabr, 2026
Pentestlar orasidagi xavfsizlik bo'shliqlarini yoping. Ushbu sessiyada agentik pentestingni o'rganing va CTEM dasturingizda doimiy ta'sirni tekshirish uchun amaliy asosga ega bo'ling.
Ro'yxatdan o'ting
Virtual tadbir: CISO Forum 2026 sammiti
10 va 11-noyabr, 2026
CISO'lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantiruvchi masalalarni ko'rib chiqish uchun birlashtirganimizda bizga qo'shiling.
Ro'yxatdan o'ting
Harakatdagi odamlar
Quantum eMotion Wayne Teeple'ni CTO etib tayinladi.
Guy Ellis NCC Group bosh direktori etib tayinlandi.
Noma Security Bobby Shoker'ni CFO va Alberto Rodrigues'ni CCO etib tayinladi.
Harakatdagi ko'proq odamlar
Mutaxassis fikrlari
Xavf shaxsiy bo'lganda: Xavfsizlik rahbarlari saraton tashxisidan nimani o'rganishi mumkin
Xavf menejerlari zaif signallarni aniqlash, uzilishlarga tayyorgarlik ko'rish va noaniqlik sharoitida qiyin qarorlar qabul qilishga o'rgatilgan. Ammo bu intizom tizim yoki korxona emas, balki siz bo'lganingizda boshqacha ko'rinadi. (Stiv Durbin)
Hech kim xavfsizlik so'rovnomasiga ishonmaydi. Biz baribir unga tayanamiz.
Deyarli har bir B2B bitimini boshqaradigan jarayon yuboruvchining ishonchsizligi va qabul qiluvchining qabul qilishi bo'lgan o'z-o'zini baholashdir. Nihoyat kompaniyalar o'rtasida ishonch uchun yaxshiroq asos mavjud. (Sravish Sridhar)
Bu normal: NetScaler nol kunlari bizga yangi normal haqida nimani aytadi
Agar Citrix NetScaler tuzatishlarining yana bir to'plami tez orada chiqarilsa, tuzatish boshqaruvi quvurlarini tayyor saqlang. (Tod Bardsli)
Zamonaviy kiberhujumlarga qarshi kurashda kontekst shohdir
Kontekstual himoya xavfsizlik jamoalariga signallarni bog'lash, keyingi qadamni oldindan ko'rish va tahdidlar kuchayishidan oldin ularni to'xtatishga yordam beradi. (Etay Maor)
AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, balki yetuklikdir
Sizning ishlab chiquvchilaringiz AI qabul qilish shkalasida qayerda joylashganligi siz xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta'sir ko'rsatadi. (Matias Madou)
Vulnerabilities
Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.
By
Ionut Arghire
| October 30, 2026 (5:32 AM ET)
*
A recent code execution vulnerability in GitLab was exploited one week after disclosure in a failed attack against Alpine Linux’s instance.
Tracked as CVE-2026-97229 (CVSS score of 10/10), the flaw stems from insufficient regular expression validation in Onigmo, Ruby’s regular expression engine.
The bug “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration,” GitLab noted in an October 12 advisory.
According to Alpine Linux, a threat actor targeted its GitLab instance with a CVE-2026-97229 exploit on October 20 and 21. The attack failed, but the Linux distribution rebuilt the instance from scratch.
“Our checks show that the aports repository, packages, and the October 21 releases were not tampered with,” Alpine Linux notes.
It is still testing the GitLab instance before public release, and has reset all passwords, warning of observed automated login attempts using passwords compromised in other leaks.
Advertisement. Scroll to continue reading.
As part of the October 20-21 attack, the hackers used a newly registered account to send crafted CI configurations to Alpine Linux’s GitLab instance, crashing the worker process.
“In 4 of those crashes, the attacker got partway through the exploit and failed at the next step. The attacker also downloaded our GitLab container image, which suggests they were tuning the exploit to our exact build. We have found no evidence that the attacker ran code on the server, but we cannot rule it out,” Alpine Linux says.
Because the underlying vulnerability resides in Ruby, not in GitLab, and the Linux distribution’s image runs standard Ruby, the vulnerability was not patched after updating to GitLab 19.3.6.
“If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later,” Alpine Linux notes.
On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.
Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
Related:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
Related:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Related:Hackers Start Probing Fresh Oracle EBS Vulnerability
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- Over 41,000 DHS Employee Records Leaked Online
- HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
- Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
- Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
- Chrome and Firefox Updates Patch Over 200 Vulnerabilities
- China-Linked Hackers Exploit PHP2Shell to Root Firewalls
- Hackers Start Probing Fresh Oracle EBS Vulnerability
- Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
Latest News
- TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
- $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
- When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis
- Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model
- How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AI
- Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps
- Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
- BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts
Trending
China-Linked Hackers Exploit PHP2Shell to Root Firewalls
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
Chrome and Firefox Updates Patch Over 200 Vulnerabilities
Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Hackers Start Probing Fresh Oracle EBS Vulnerability
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: Agentic Pentesting for a Stronger CTEM Program
November 4, 2026
Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Quantum eMotion has named Wayne Teeple as CTO.
Guy Ellis has been appointed CEO of NCC Group.
Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.
More People On The Move
Expert Insights
*
When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)
Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
