Alpine Linux rebuilt its GitLab server and reset all passwords after attempted exploitation of CVE-2026-97229 on October 20–21. It found no evidence of successful execution but could not rule it out because some logs were missing. Updating GitLab alone had left its custom image vulnerable because Ruby lacked the fix. Operators using a separate Ruby installation should verify version 3.3.13, 3.4.12, 4.0.9 or later; Ruby’s official release also lists the regular-expression fixes. No tampering was found in the checked packages and releases, and signing keys were not stored on the affected server.