"The attack came close to working," the maintainers of Alpine Linux wrote after an unknown actor probed an unpatched GitLab instance in late October 2026, forcing them to treat the instance as compromised and rebuild it from scratch.
CISA adds CVE-2026-97229 and CVE-2026-76418 to the Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two vulnerabilities — CVE-2026-97229 and CVE-2026-76418 — to its Known Exploited Vulnerabilities (KEV) list, citing evidence of active exploitation. CISA's action marks both flaws as requiring priority attention by affected organizations and federal agencies.
CVE-2026-97229 carries a CVSS score of 10.0 and is described as an integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration due to insufficient regular expression validation.
CVE-2026-76418 has a CVSS score of 8.6 and is described as an unchecked return value to NULL pointer dereference vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition.
Alpine Linux incident: probes on October 20–21, blocked attempts on October 25–26
The addition of CVE-2026-97229 to KEV follows a security incident disclosed by Alpine Linux. According to Alpine's maintainers, an unknown threat actor probed an unpatched GitLab instance on October 20 and 21, 2026, by sending crafted CI configurations that caused GitLab worker processes to crash eight times.
In four of those crashes, Alpine said, the exploit failed at the next step. The actor also downloaded Alpine Linux's GitLab container image. Subsequent attempts by the attacker to regain access on October 25 and 26 were blocked. Alpine's maintainers reported: "We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCisco Secure Firewall issue: active exploitation but limited public detail
Cisco has said it became aware of active exploitation of CVE-2026-76418 earlier in October 2026. The vendor has not publicly identified the attackers, the number of targeted organizations, or what actions attackers took after gaining initial access. The vulnerability affects Cisco Secure Firewall ASA and FTD software and can cause an unexpected device reload leading to denial-of-service.
Because the exploit vector is unauthenticated and remote, the risk profile for exposed firewall appliances and virtual instances is material for organizations that run these products without mitigations or applied fixes.
Federal Civilian Executive Branch (FCEB) timeline and immediate action
In light of the evidence of active exploitation, CISA recommends that Federal Civilian Executive Branch (FCEB) agencies apply the fixes by November 1, 2026. That deadline frames the federal remediation window and signals the urgency CISA attributes to both the GitLab and Cisco flaws.
The FCEB recommendation is explicit: agencies are expected to prioritize patching or applying vendor mitigations for the two KEV-listed vulnerabilities on the CISA timetable.
How technologists, FCEB agencies, and open-source maintainers are responding
- Technologists and security teams maintaining GitLab instances: the GitLab flaw allows unauthenticated arbitrary code execution via CI/CD configuration regular expressions; teams will need to prioritize applying the available fixes and review the exposure of CI runners and worker processes.
- FCEB agencies: CISA's November 1, 2026, remediation timeline specifically directs federal civilian agencies to implement fixes within the stated window.
- Open-source maintainers (Alpine Linux): maintainers treated the probed instance as compromised, rebuilt the instance from scratch, and verified that the aports repository, packages, and the October 21 releases were not tampered with.
What remains concrete from the record is this: CISA has elevated two high-severity flaws — one enabling possible remote code execution against GitLab via crafted CI/CD regular expressions, the other causing reloads and DoS on Cisco firewall software — into the KEV catalog because there is active exploitation. Alpine Linux's incident shows how close an exploitation attempt can come to success and why maintainers sometimes treat uncertain intrusions as full compromises. The federal remediation deadline — November 1, 2026 — sets an immediate compliance clock for FCEB agencies and a practical signal for other organizations to follow.
Original story: https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html
