Maximum-Severity GitLab Flaw Is Under Active Attack — and It Nearly Broke Into Alpine Linux

CISA has added GitLab's CVE-2026-97229, a perfect 10.0, and a Cisco firewall flaw to its exploited list. Federal agencies have until 1 November to patch. Some vulnerabilities are theoretical. These are not. On Thursday, the US Cybersecurity and Infrastructure Security Agency (CISA) added two more flaws to its Known Exploited Vulnerabilities (KEV) catalog — the official list of bugs attackers are using right now. One is a flaw in GitLab, the code-hosting platform used by development teams everywhere, with the highest severity score that exists: 10.0 out of 10. The other can knock Cisco firewalls offline. One of them has already been fired at a real target — and the defenders say it came close to working. A 10-out-of-10 flaw in GitLab The GitLab vulnerability, tracked as CVE-2026-97229, affects both the Community Edition and Enterprise Edition of the software. It is an integer overflow flaw rooted in weak validation of regular expressions: by sending a specially crafted regular expression inside a CI/CD configuration, an unauthenticated attacker — someone with no account and no password — can execute arbitrary code on the GitLab server itself. That last part is what makes a 10.0 score. GitLab servers hold source code, build pipelines and often the keys that deploy software to production. An attacker who can run code on one, without logging in, potentially owns everything that flows through it. Anyone running their own GitLab instance should treat this as patch-first, ask-questions-later. The night it was aimed at Alpine Linux We know this flaw is being used because one target has told the story in public. Alpine Linux, the security-focused Linux distribution, disclosed that an unknown attacker tried to exploit the flaw against its GitLab instance on 20 and 21 October. The attacker probed the unpatched server by sending crafted CI configurations, which crashed the GitLab worker processes eight times. In four of those crashes, the exploit then failed at the next step. The attacker also downloaded Alpine's GitLab container image — likely to study it for a better attempt — and further tries to get back in on 25 and 26 October were blocked. Alpine's maintainers were candid about how near a thing it was. "The attack came close to working," they said. "We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch." Their checks showed that the aports repository, the packages and the 21 October releases were not tampered with — the outcome every software project hopes for, and one that depended on the exploit stumbling at the final step. The Cisco firewall flaw travelling with it The second addition, CVE-2026-76418, scores 8.6 and affects Cisco's Secure Firewall ASA and FTD software — the appliances many organisations use as their front door to the internet. A flaw in how the software handles a return value can let an unauthenticated remote attacker force the device to reload unexpectedly: in plain language, knock the firewall offline at will, repeatedly. Cisco said it became aware of active exploitation of this vulnerability earlier in October. It has not publicly identified who the attackers are, how many organisations they targeted, or what they did after getting in — a silence that usually means the picture is still developing. A denial-of-service flaw in a firewall sounds less dramatic than code execution, but a front door that can be slammed shut on demand is a powerful tool during a larger attack. The deadline Because both flaws are confirmed to be under exploitation, CISA's KEV listing comes with a clock. US Federal Civilian Executive Branch agencies are expected to apply the fixes by 1 November 2026. Everyone else gets no formal deadline — just the knowledge that attackers are already scanning for these bugs, and that the interval between "flaw disclosed" and "flaw mass-exploited" is now measured in days. It is worth noting how quickly this moved. The Alpine Linux attack happened on 20–21 October; by the end of the month the flaw had a name, a maximum score and a federal patch deadline. Defenders had roughly a week of warning, most of which existed only because a small open-source project chose to publish its near-miss. What this means for you If your team self-hosts GitLab, patch it now. This is the whole ballgame: unauthenticated code execution on the machine that holds your code. Do not wait for a maintenance window. If you run Cisco ASA or FTD firewalls, apply Cisco's updates and watch for unexpected reloads — they may be a symptom, not a glitch. Treat "we run it ourselves" as a responsibility, not a saving. Self-hosted tools like GitLab are only safer than cloud versions if someone is watching for exactly this kind of alert. Ordinary users: you cannot patch someone else's server, but this is a reminder of why services you use sometimes go down for "emergency maintenance." This week, some of that maintenance is this. Sources The Hacker News, "CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV," 30 October 2026 — http://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html Originally published on The Daily Tech Watch: https://dailytechwatch.blogspot.com/2026/10/gitlab-cve-2026-97229-active-exploitation-cisa.html