--- title: "GitLab stock hit its 52-week high the day Alpine's GitLab was rebuilt from scratch" description: "A CVSS 10.0 flaw GitLab patched on October 12 nearly let an attacker run code inside the server that builds Alpine Linux, because the fix ships inside GitLab's own Ruby, not Ruby itself. Self-managed operators absorb the cost, and GTLB touched its 52-week high the day it surfaced." publisher: "The Inference" section: "Security" published: 2026-10-29T15:17:22.921Z modified: 2026-10-29T15:17:22.921Z canonical: https://theinference.org/article/gitlab-stock-hit-its-52-week-high-the-day-alpine-s-gitlab-was-rebuilt-from-scratch language: en keywords: "GitLab, Cybersecurity, Alpine Linux, Vulnerabilities, DevOps" --- # GitLab stock hit its 52-week high the day Alpine's GitLab was rebuilt from scratch > A CVSS 10.0 flaw GitLab patched on October 12 nearly let an attacker run code inside the server that builds Alpine Linux, because the fix ships inside GitLab's own Ruby, not Ruby itself. Self-managed operators absorb the cost, and GTLB touched its 52-week high the day it surfaced. An attacker spent six days trying to run code inside the server that builds Alpine Linux, and the vulnerability was one [GitLab](https://theinference.org/markets/companies/gitlab) had already patched. The patch is the problem: it lives in the copy of Ruby inside GitLab's own packages and container images, and Alpine's GitLab image used standard Ruby, so the server was upgraded twice and stayed vulnerable [1]. Investors got the other half of the story the same day: GitLab stock [printed a 52-week high of $57.89](https://www.investing.com/news/company-news/gitlab-stock-hits-52week-high-at-5789-usd-93CH-4979858) on October 28, the day Alpine disclosed the attempt [2]. ## The attack was patient, and the fix sat in the wrong place [Rapid7](https://theinference.org/markets/companies/rapid7) [published working proof-of-concept code for CVE-2026-97229](https://theinference.org/article/rapid7-turns-gitlab-s-10-0-flaw-into-a-live-product-demo-three-weeks-before-earnings), a CVSS 10.0 flaw that lets an unauthenticated user run code through a crafted regular expression in CI configuration, on October 13 [1]. A week later, a newly registered account sent crafted CI configurations to gitlab.alpinelinux.org, which hosts aports, the repository from which every Alpine package is built. Workers crashed eight times. Four of those attempts got partway through the exploit before failing at the next step, and the attacker also downloaded Alpine's own container image, which Alpine read as tuning the attack to its exact build. It came back after being blocked [1]. ## No proof either way, so Alpine rebuilt from scratch Alpine could not prove no code ran: a successful exploit leaves no crash and no trace in web logs, and the logs that would have settled it are gone, along with any outbound connection records [1][3]. So Alpine [rebuilt the server from scratch](https://www.startuphub.ai/cybersecurity/alpine-gitlab-exploit-came-close-forced-rebuild) by October 28 and reset every password and secret key [1]. ## The bill lands on self-managed operators [GitLab.com and GitLab Dedicated were already patched](https://theinference.org/article/gitlab-s-second-10-0-severity-patch-in-nine-days-hits-self-managed-servers-with-downtime-not-gitlab-com). The risk, the downtime and the password resets belong to everyone who runs the platform on their own servers [1][4]. And the guidance gap is still open: as of October 29, GitLab's patch notes do not tell self-compiled installers to update Ruby, and its installation guide still lists Ruby 3.2, which stopped receiving fixes in April, as the minimum version [1]. This is also the fourth code-execution flaw in the same regex engine [reported by one researcher in a month](https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html) [5]. The code is fixed. The link that now limits the outcome is the vendor telling operators, in the place they patch from, that upgrading GitLab is not enough. ## What it means for GTLB Two forces pull at the stock at a premium. Every incident like this is an argument for the hosted tiers, where the fix was already running while self-managed users scrambled; that is a sales argument, not a cost. Against it sits brand risk: the build source for an entire distro sat exposed, and Alpine has not said whether runner tokens and CI/CD variables were rotated [1]. The hosted tier is the moat, and this week it sold itself. ## Takeaway GitLab's fix for CVE-2026-97229 ships inside its bundled Ruby, so self-managed operators, not GitLab, absorbed the six-day attack on Alpine's build server; the hosted tiers were already patched and GTLB touched a 52-week high as the story broke. ## Sources 1. [The Hacker News, Attacker Tried to Exploit Alpine Linux's GitLab via CVSS 10.0 Flaw Its Ruby Left Open, 29 October 2026](https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html) 2. [Investing.com, Gitlab stock hits 52-week high at 57.89 USD, 28 October 2026](https://www.investing.com/news/company-news/gitlab-stock-hits-52week-high-at-5789-usd-93CH-4979858) 3. [StartupHub.ai, Alpine GitLab exploit came close, forced rebuild, 29 October 2026](https://www.startuphub.ai/cybersecurity/alpine-gitlab-exploit-came-close-forced-rebuild) 4. [Help Net Security, GitLab admins urged to patch critical RCE flaw (CVE-2026-97229), 13 October 2026](https://www.helpnetsecurity.com/2026/10/13/gitlab-ci-cd-regular-expression-compiler-vulnerability-cve-2026-97229/) 5. [The Hacker News, Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases, 21 October 2026](https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html) --- GitLab stock hit its 52-week high the day Alpine's GitLab was rebuilt from scratch — The Inference. Canonical: https://theinference.org/article/gitlab-stock-hit-its-52-week-high-the-day-alpine-s-gitlab-was-rebuilt-from-scratch