GitLab stock hit its 52-week high the day Alpine's GitLab was rebuilt from scratch
A CVSS 10.0 flaw GitLab patched on October 12 nearly let an attacker run code inside the server that builds Alpine Linux, because the fix ships inside GitLab's own Ruby, not Ruby itself. Self-managed operators absorb the cost, and GTLB touched its 52-week high the day it surfaced.
Richard Tang · 3 min read
An attacker spent six days trying to run code inside the server that builds Alpine Linux, and the vulnerability was one GitLab−2.76% — GitLab, down 2.76 percent today had already patched. The patch is the problem: it lives in the copy of Ruby inside GitLab's own packages and container images, and Alpine's GitLab image used standard Ruby, so the server was upgraded twice and stayed vulnerable 1. Investors got the other half of the story the same day: GitLab stock printed a 52-week high of $57.89 on October 28, the day Alpine disclosed the attempt 2.
The attack was patient, and the fix sat in the wrong place
Rapid7−7.07% — Rapid7, down 7.07 percent today published working proof-of-concept code for CVE-2026-97229, a CVSS 10.0 flaw that lets an unauthenticated user run code through a crafted regular expression in CI configuration, on October 13 1. A week later, a newly registered account sent crafted CI configurations to gitlab.alpinelinux.org, which hosts aports, the repository from which every Alpine package is built.
Workers crashed eight times. Four of those attempts got partway through the exploit before failing at the next step, and the attacker also downloaded Alpine's own container image, which Alpine read as tuning the attack to its exact build. It came back after being blocked 1.
No proof either way, so Alpine rebuilt from scratch
Alpine could not prove no code ran: a successful exploit leaves no crash and no trace in web logs, and the logs that would have settled it are gone, along with any outbound connection records 13. So Alpine rebuilt the server from scratch by October 28 and reset every password and secret key 1.
The bill lands on self-managed operators
GitLab.com and GitLab Dedicated were already patched. The risk, the downtime and the password resets belong to everyone who runs the platform on their own servers 14.
And the guidance gap is still open: as of October 29, GitLab's patch notes do not tell self-compiled installers to update Ruby, and its installation guide still lists Ruby 3.2, which stopped receiving fixes in April, as the minimum version 1. This is also the fourth code-execution flaw in the same regex engine reported by one researcher in a month 5. The code is fixed. The link that now limits the outcome is the vendor telling operators, in the place they patch from, that upgrading GitLab is not enough.
What it means for GTLB
Two forces pull at the stock at a premium. Every incident like this is an argument for the hosted tiers, where the fix was already running while self-managed users scrambled; that is a sales argument, not a cost. Against it sits brand risk: the build source for an entire distro sat exposed, and Alpine has not said whether runner tokens and CI/CD variables were rotated 1. The hosted tier is the moat, and this week it sold itself.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
