Changed since version 0

• CISA KEV listed CVE-2026-97229 on 2026-10-29 (federal due 2026-11-01)

What happened

• Alpine Linux said an attacker sent crafted CI configurations with malicious regular expressions to its GitLab server on 20-21 October 2026, about a week after GitLab's fix [S1]
• The attempts crashed GitLab worker processes 8 times, caused 502 errors and made CI jobs fail [S1]
• Alpine found no evidence the exploit ran code but could not rule it out, so it rebuilt the server and reset all passwords [S1]
• The GitLab CVEs depend on three Onigmo bugs fixed in Ruby 4.0.9, 3.4.12 and 3.3.13. These bugs can corrupt memory while Ruby compiles a crafted pattern [S3]
• Upgrading GitLab alone does not fix self-compiled installs or images that bring their own Ruby [S1][S3]
• The companion flaw CVE-2026-110264 is an unauthenticated RCE reported to reach every self-managed release since 7.0. GitLab disclosed no preconditions or workaround for it [S2]

Timeline

Detect

Ruby crash reports pointing to Onigmo · GitLab application logs / Ruby crash reports

index=* ("[BUG]" OR "Segmentation fault" OR "SIGSEGV") (onig OR regcomp OR regparse OR "Regexp") (puma OR sidekiq) | stats count min(_time) as first max(_time) as last by host, source

FROM logs-* | WHERE (message LIKE "*[BUG]*" OR message LIKE "*Segmentation fault*" OR message LIKE "*SIGSEGV*") AND (message LIKE "*onig*" OR message LIKE "*regcomp*" OR message LIKE "*regparse*" OR message LIKE "*Regexp*") AND (message LIKE "*puma*" OR message LIKE "*sidekiq*") | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name, log.file.path

A hit means: A GitLab worker crashed inside regex compilation. This matches the crash pattern Alpine saw. Treat it as an exploitation attempt until verified.

Unexpected child processes of Puma or Sidekiq · Process events / EDR on GitLab servers

index=* (parent_process_name="*puma*" OR parent_process_name="*sidekiq*") (process_name=sh OR process_name=bash OR process_name=dash OR process_name=curl OR process_name=wget OR process_name=nc OR process_name=python* OR process_name=perl) | stats count min(_time) as first max(_time) as last values(process) as cmdlines by host, parent_process_name, process_name

FROM logs-* | WHERE (process.parent.name LIKE "*puma*" OR process.parent.name LIKE "*sidekiq*") AND (process.name IN ("sh", "bash", "dash", "curl", "wget", "nc", "perl") OR process.name LIKE "python*") | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp), cmdlines = VALUES(process.command_line) BY host.name, process.parent.name, process.name

A hit means: A GitLab web or job worker spawned a shell or a network tool. If the crafted-regex attempt succeeded, this is the likely follow-on [S1]. Escalate to IR.

GraphQL ciLint requests and CI regexp warnings · GitLab application logs (GraphQL / production logs)

index=* ("ciLint" OR "CiLint" OR "regexp" AND "warning") | stats count min(_time) as first max(_time) as last by host, remote_ip

FROM logs-* | WHERE message LIKE "*ciLint*" OR message LIKE "*CiLint*" OR (message LIKE "*regexp*" AND message LIKE "*warning*") | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name, source.ip

A hit means: CI configurations were linted or carried regexp warnings. Bursts from one source, especially before worker crashes, fit the CI-regex delivery Alpine described.

Verify

• Line up the times of crashes, 502 bursts and CI job failures with pushes of .gitlab-ci.yml changes or unusually long non-ASCII file paths [S1]
• For a true positive, look for git-owned files in /tmp, outbound connections from the GitLab host, and changed crontabs or SSH keys for the git user [S1]
• Benign look-alike: Sidekiq and Puma legitimately spawn git and helper processes. Baseline normal children before alerting
• Benign look-alike: memory pressure or OOM kills also crash workers and produce 502s. Check whether the crash trace mentions Onigmo
• Benign look-alike: developers routinely use the CI lint feature

Scope

Affected

• Self-managed GitLab 19.3.4, 19.3.5 and 19.4.1 for CVE-2026-97229; 19.4.1 confirmed in a Rapid7 lab test [S1]
• Self-compiled GitLab, or container images that install their own Ruby, running Ruby older than 3.3.13, 3.4.12 or 4.0.9 [S1][S3]
• Any Ruby application that compiles regexes from attacker-controlled strings via Regexp.new, Regexp.union, Regexp.compile or interpolation [S3]
• CVE-2026-110264: self-managed releases back to 7.0 [S2]

Only if

• The crafted .gitlab-ci.yml and UTF-8 file path must be committed to a branch of a public project, unless new users can self-register and create projects (CVE-2026-97229) [S1]
• Ruby is not patched. The GitLab Linux package and official images carry patched Ruby [S1]

Not affected if

• GitLab.com and GitLab Dedicated (already patched) [S1]
• Linux package or official container image installs at the newest release for their branch [S1]
• Branch 19.5 is listed as not affected for CVE-2026-97229 [S1]

Fixed in: GitLab 19.3.6, 19.4.2, 19.2.9, 19.1.9, 19.0.10, 18.11.13; plus Ruby 3.3.13, 3.4.12 or 4.0.9 for self-compiled and custom-Ruby installs [S1][S3]

Enumerate

• Every self-managed GitLab instance: version, branch and install type (Linux package, official image, self-compiled, custom image)
• Ruby version on self-compiled and custom-image installs
• Instances with public projects, or with open self-registration and project creation
• Other internal Ruby apps that build regexes from user input
• Accounts, tokens and CI runners reachable from each GitLab server, to size any password and token reset

Contain

• Upgrade to a fixed GitLab release, and to fixed Ruby where GitLab does not ship it [S1][S3]
• Until patched, disable open self-registration and review public projects. This removes the stated attack precondition [S1]
• Before any rebuild, preserve application logs, Ruby crash reports, web access logs and process telemetry from 20 October onward
• If compromise cannot be ruled out, isolate and rebuild the server and reset passwords, as Alpine did [S1]. These steps cannot be undone: a rebuild destroys volatile evidence, and resets invalidate existing credentials
• Rotate tokens and CI secrets stored on any server with a confirmed hit. This cannot be undone

Eradicate

• Remove git-owned files in /tmp and any added crontabs or SSH keys for the git user [S1]
• Where code execution is suspected, rebuild from a known-good image rather than cleaning in place [S1]
• Close the root cause by running a fixed GitLab release on patched Ruby [S1][S3]

Recover

• Before restoring, confirm the GitLab version and the Ruby version on the rebuilt host
• Before restoring, confirm credentials and tokens were reset
• After restoring, watch for worker crashes, 502 bursts, unexpected Puma or Sidekiq children and outbound connections [S1]

Re-enter the loop when

• Any source confirms code execution from these attempts, or publishes new IoCs or attacker infrastructure
• GitLab revises the affected branch list. The 19.5 status and the prior card's release data conflict
• Exploitation of CVE-2026-110264 or the two logged-in Onigmo CVEs is reported [S3]
• Crash or process hits appear on a GitLab instance outside the patched set

Debrief

• Record patch dates for each instance against the 20-21 October attack window
• Record which install types needed separate Ruby patching
• Gap: no published IoCs (IPs, payload hashes) from Alpine's incident
• Gap: preconditions for CVE-2026-110264 remain undisclosed [S2]
• Gap: none of the numbered sources is a vendor, Ruby or CISA primary document

Detection coverage — checked automatically

Checked automatically 2026-11-10 05:36Z from public sources: 15 published, 20 nothing found, 0 not machine-checkable, 1 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2026-97229 — Ruby 4.0.9, 3.4.12 and 3.3.13 fix Onigmo regex bugs behind four critical GitLab RCE CVEs; CVE-2026-110264 — Ruby 4.0.9, 3.4.12 and 3.3.13 fix Onigmo regex bugs behind four critical GitLab RCE CVEs. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-97229

vuln:CVE-2026-110264

cpe:"cpe:/a:gitlab:gitlab"

product:"Gitlab"

host.services: (software.product = "Gitlab")

http.html:"GitLab Community Edition"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD names 2 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Banner spellings: a model read 2 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest was dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 05:36Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• CISA KEV listing of CVE-2026-97229 on 2026-10-29 (federal due 2026-11-01) comes from the pipeline change feed with no numbered source. Confirm against the CISA KEV catalog
• The count of GitLab Sigma rules (six, four experimental, per pipeline guidance; the prior card said two) is not traced to a numbered source. Confirm against GitLab's advisory
• The prior card's 'Oct 12 patches do not cover it' and '19.5.1 critical release' cannot be checked against current sources. They also conflict with 19.5 being listed as not affected
• The prior card's statement that a public PoC is circulating is not reconfirmed by the current sources

Sources

• [S1] https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html · The Hacker News
• [S2] https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html · The Hacker News
• [S3] https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html · The Hacker News

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.