All incidents

On October 12 GitLab patched CVE-2026-97229, an integer overflow in the regular-expression compiler that processes CI/CD pipeline files. It could let an unauthenticated attacker run code on self-managed GitLab CE and EE servers (CVSS 10.0). Rapid7 published a proof of concept on October 13, and Censys counted about 25,800 exposed vulnerable hosts. Alpine Linux says an attacker sent exploit attempts at its own GitLab server on October 20 and 21; the attack failed and Alpine rebuilt the instance. On October 29 CISA added CVE-2026-97229 to its exploited list, with a federal deadline of November 1. On October 21 GitLab fixed a second maximum-severity flaw, CVE-2026-110264, another integer overflow in the same regular-expression compiler; the affected code dates to 2014. GitLab.com is already fixed. GitLab has not said whether the second flaw has been exploited, and it was not on CISA's list as of October 30. Servers patched on October 12 are still affected by it, and there is no workaround. Alpine's experience also shows that upgrading GitLab may not be enough if you run your own Ruby: its image uses standard Ruby, and the flaw was not fixed after it updated to GitLab 19.3.6.