First screen, captured 1 day ago. Hover to scroll the page, or open the video.

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229

What HN thinks

Patch Tuesday has become Patch Every Day, and the regex is coming from inside the house.

Self-builders are stuck on a treadmill
The fix lived in a patched Ruby, not GitLab, so anyone building their own images stayed vulnerable; commenters say only automated rebuilds or putting things behind a VPN keep up.
Ruby should have issued CVEs
By declining CVE identifiers, Ruby left scanners and automated updaters with nothing to match, even if compiling untrusted regexes is a bad idea.
Time to retire C for network code
An integer overflow and double free in a C regex engine fuels calls for memory-safe languages, with pushback that rewrites bring their own bugs.

Consensus: Most agree that version-based scanning and pinned dependencies gave false confidence here, and that keeping self-hosted software patched is getting exhausting.

Recommended in the comments

Forgejo (product): Suggested as a smaller attack surface than GitLab, though others noted it has had critical bugs too.
Renovate (tool): Suggested as a way to get notified when pinned image digests change.
RE2 (library): Cited as a true regular-language engine that is safer for untrusted patterns.
Woodpecker CI (tool): Paired with Gitea as a lighter alternative to GitLab CI.

Summarised by Claude from the comment thread 16 hours ago.

Points: 236
Comments: 109
Best rank: #2
Posted: 2026-10-28 by sashk
Category: Security

alpine-linux gitlab incident-report ruby onigmo cve supply-chain

All captures:

Full page

Captured 1 day ago. Click for the whole screenshot.

Looks similar

Screenshot of alpinelinux.org: Implementing /Usr Merge in Alpine

Implementing /Usr Merge in Alpine (alpinelinux.org)

21 points by rascul 1 year ago | 25 comments

Screenshot of alpinelinux.org: Alpine Linux 3.24.0 Released

Alpine Linux 3.24.0 Released (alpinelinux.org)

109 points by fossdd 4 months ago | 19 comments

Screenshot of clojure.org: Java 21 VirtualThreads vs. Clojure Lazy Seqs

Java 21 VirtualThreads vs. Clojure Lazy Seqs (clojure.org)

197 points by grzm 3 years ago | 121 comments

Screenshot of docs.gitlab.com: GitLab critical patch release

GitLab critical patch release (docs.gitlab.com)

395 points by artooro 8 days ago | 92 comments

GitLab's critical patch release notes for versions 19.5.1 and backports, fixing a CVSS 10.0 regex compiler integer overflow RCE and other security issues.

gitlab cve remote-code-execution integer-overflow

Screenshot of openssh.org: OpenSSH 10.5/10.5p1

OpenSSH 10.5/10.5p1 (openssh.org)

103 points by voxadam 2 months ago | 32 comments

Screenshot of broccoli2shell.com: Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more

Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more (broccoli2shell.com)

384 points by theanonymousone 5 days ago | 200 comments

Aikido blog post explaining CVE-2026-111497, a critical Brotli decoder out-of-bounds write affecting Node.js, Python, and HTTP libraries, with patch versions and workarounds.

brotli cve-2026-111497 node2shell nodejs