Alpine Linux said on 28 October that an attacker tried to exploit CVE-2026-97229 against the project's own GitLab server. The attempt came about a week after GitLab released a fix. Alpine reported no evidence that the attack succeeded. SecurityWeek's headline describes the flaw as exploited against Alpine, but the project's own account stops short of a confirmed compromise.
The bug affects GitLab Community and Enterprise editions from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. According to NVD, an unauthenticated attacker could run code on the server under certain conditions by placing a crafted regular expression in a CI/CD configuration. NVD attributes this to weak regex validation, while CISA classifies it as an integer overflow. EPSS gives it a 27% chance of exploitation in the next 30 days.
On 29 October CISA added the GitLab flaw to its Known Exploited Vulnerabilities catalog. It also added CVE-2026-76418 (CVSS 8.6), a flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD software. When secondary authentication is configured on a tunnel group, an unauthenticated attacker can send a crafted request that makes the device reload, causing a denial of service. CISA set a federal patch deadline of 1 November for both flaws.
Self-managed GitLab instances should be moved to a fixed release now. Cisco ASA and FTD users with SSL VPN and secondary authentication enabled should check Cisco's guidance for fixed software. The reports do not name fixed Cisco versions.