Threat Pulse 62High
Max-severity GitLab flaw CVE-2026-97229 exploited (Alpine Linux targeted); CISA KEV
Severity 7ActiveconfirmedCloud and SaaS

CISA added GitLab CE/EE CVE-2026-97229 (CVSS 10 RCE) and Cisco Secure Firewall ASA/FTD CVE-2026-76418 (reload and DoS) to KEV on Oct 29; federal deadline Nov 1. The GitLab flaw was used in an attempted attack on Alpine Linux.

What to do: Nov 2: Shadowserver: 1,000+ GitLab servers still vulnerable to CVE-2026-97229 and 11,300+ to CVE-2026-110264 (of about 39,000). Alpine Linux rebuilt its GitLab after the attempted attack.

· 6 days ago · cisa.gov
Sourcescisa.govbleepingcomputer.comsecurityweek.comThe Hacker NewsCISA Known Exploited VulnerabilitiesThe Hacker NewsBleepingComputerbleepingcomputer.com
On X
@CISACyberverifiedOct 29, 21:32 UTC

🛡️We added GitLab Community Edition & Enterprise Edition vulnerability CVE-2026-97229 & Cisco Secure Firewall ASA Software and Cisco Secure FTD Software vulnerability CVE-2026-76418 to our KEV Catalog. Visit for more. #Cybersecurity #InfoSec

Open on X
@BleepinComputerverifiedOct 30, 13:01 UTC

CISA says max severity GitLab flaw now exploited in the wild

Open on X
@SecurityWeekverifiedOct 30, 09:34 UTC

Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

Open on X
@ShadowserververifiedNov 1, 20:46 UTC

We are currently tracking over 1000 GitLab instances vulnerable to CVE-2026-97229 (on @CISACyber KEV) and over 11300 instances vulnerable to CVE-2026-110264 (out of around 39K GitLab instances we see daily). Tree Map Dashboard stats (both vulns)

Open on X
@BleepinComputerverifiedNov 2, 12:47 UTC

Over 1,000 GitLab servers vulnerable to ongoing RCE attacks

Open on X
@BleepinComputerverifiedNov 1, 15:12 UTC

Alpine Linux rebuilds GitLab after attempted RCE attack

Open on X
Why this score

Plan rubric with caps (verified sweep, Oct 31)

Back to the board

Updated Nov 5, 01:45 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.