Attackers try GitLab CI regex RCE (CVE-2026-97229) on self-hosted GitLab; upgrading GitLab does not fix installs that use their own Ruby

Alpine Linux reports that on 20-21 Oct 2026 a newly registered account sent crafted CI configurations to its self-hosted GitLab (19.3.4, unpatched) to exploit CVE-2026-97229, a CVSS 10.0 bug in Ruby's Onigmo regex engine reached through GitLab's CI config regex evaluation. Worker processes crashed 8 times, 4 times partway through the exploit. The attacker downloaded Alpine's GitLab container image to tune the exploit to that build and came back on 25-26 Oct. Alpine found no proof of code execution but could not rule it out, so it rebuilt the instance and reset all passwords and secret keys. The catch: GitLab's fix (released 12 Oct) is a patch to the Ruby bundled in its official packages and images. GitLab built from source or in custom images on standard Ruby stays exploitable after upgrading GitLab (Alpine was still exposed on 19.3.6) until Ruby is 3.3.13, 3.4.12, 4.0.9 or later (released 23 Oct). Any Ruby program that compiles regexes from untrusted input is also exposed. Anyone who lets the public register accounts on a self-hosted GitLab is at risk. Who is behind it is unknown, and so is whether other instances were hit.

Summary written from the sources below. Check the originals before acting.