Alpine Linux rebuilds GitLab after attempted RCE attack
The notable thing here is that Alpine acted before it had proof of a compromise. Rebuilding a GitLab server and resetting every password is a heavy, disruptive move for a volunteer-run project, but the alternative, trying to audit a possibly rooted instance, is worse. If an attacker got code execution, even briefly, the source code and CI pipelines could be tainted in ways that are nearly impossible to trace. Nuking it all is the only honest response.
This also lands as a near-miss for the software supply chain. Alpine is the base for countless container images, and its GitLab is where packages and releases get built. An attacker who reached that server could have planted something far more damaging than a defaced website. The fact that the exploit attempt failed, or at least wasn't confirmed to succeed, is small comfort; the incident shows how much trust we place in a handful of overstretched maintainers.
I'd want to know how the attempt was detected and whether Alpine has added extra monitoring since. But for now, the rebuild is the right call, and other projects should treat it as a template for incident response.