---
title: "Comment by Damiano Bianda on \"GitLab CVE-2026-110264: CVSS 10.0 RCE Hits 12 Years of Releases\" | Hashnode"
description: "What made this family real for operators: CVE-2026-97229, one of the four, is already in CISA's Known Exploited Vulnerabilities catalog after the Alpine Linux i"
url: "https://hashnode.com/posts/alert-gitlab-cve-2026-110264-rce/6ada4e4a4601ccec5f7882df/comment/6ae46fa800da92b8af14d174"
---

[Discussion](https://hashnode.com/posts/alert-gitlab-cve-2026-110264-rce/6ada4e4a4601ccec5f7882df)

Comment [GitLab CVE-2026-110264: CVSS 10.0 RCE Hits 12 Years of Releases](https://hashnode.com/posts/alert-gitlab-cve-2026-110264-rce/6ada4e4a4601ccec5f7882df)

[Damiano Bianda](https://hashnode.com/@damianobianda)

[Oct 30](https://hashnode.com/posts/alert-gitlab-cve-2026-110264-rce/6ada4e4a4601ccec5f7882df/comment/6ae46fa800da92b8af14d174)

What made this family real for operators: CVE-2026-97229, one of the four, is already in CISA's Known Exploited Vulnerabilities catalog after the Alpine Linux incident in October - a newly registered account crashed GitLab worker processes 8 times with crafted CI configs, got partway through the exploit on 4 of them, and even downloaded Alpine's container image to tune the attack. Those repeated crashes were the only visible tell, so repeated worker crashes under regex-heavy CI configs this month are not noise. One more useful detail: the upstream Ruby releases of October 23 (3.3.13 / 3.4.12 / 4.0.9) fix all four CVEs, but each maps to a different Ruby change, so "we patched Ruby" is worth verifying per release line.