One Click Digital Risk Protection platform to protect from digital external threats, detect and prevent breach epidemic from surface, deep and Dark web.

はじめに 版番号が上がっても、その番号が指す中身が自分の環境に入っているとは限りません。今回の5本は、どれも「見えている部分」と「見えていない部分」のずれの話として読めます。Alpine Linux の GitLab は、版を上げても、修正が入っていない Ruby のまま動いていました。Fedora 45 は判定会議を通りましたが、確認時点では出荷前です。Linux 7.2 系は 7.2.15 で更新が止まり、そこに入った skb_zerocopy の修正は、番号の新しい 7.3.1 のコミットの件名には見当たりません。Langflow は修正版が先に出ていて、あとから CVE が公開されました。LXD は、証明書の鎖のうち、先頭の1枚しか鍵の所有を証明していませんでした。\n

Alpine Linux had upgraded to GitLab 19.3.6, but its environment remained vulnerable to CVE-2026-97229. Its container image used standard Ruby, where the vulnerability resided. The incident shows why an application version alone cannot establish that the vulnerable dependency has been fixed. ## What happened CVE-2026-97229 has a CVSS score of 10/10 and stems from insufficient regular expression validation in Onigmo, Ruby’s regular expression engine. GitLab said the flaw could allow unauthenticated users to execute arbitrary code on the server through specially crafted regular expressions in CI/CD configuration. On October 20 and 21, a threat actor targeted Alpine Linux’s GitLab server. According to Alpine Linux, the attacker used newly registered accounts to submit specially crafted CI configuration, causing worker processes to crash. Those crashes were observed; server-side code execution remained uncertain. The attack was reported as unsuccessful. Alpine Linux, however, said it had found no evidence that the attacker executed code on the server while acknowledging that it could not rule out that possibility. Alpine Linux rebuilt the server from scratch. Its checks found no tampering with the aports repository, packages, or releases dated October 21. Those findings apply to the named assets and do not resolve the uncertainty about code execution. ## TMGS recommendations TMGS recommends that organizations operating their own GitLab deployments verify dependencies before closing patch tickets: * Inventory the deployed GitLab and Ruby versions and the container image’s origin. * Confirm that remediation addresses the vulnerable component, then verify the running environment after updating. * Assign responsibility for verification across application and infrastructure teams. * Preserve logs covering new accounts, CI configuration changes, and worker failures when suspicious activity appears. * Check source code and release package integrity when server compromise is suspected. The acceptance criterion should be evidence that the vulnerable component has been addressed in the running system. Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/cap-nhat-gitlab-chua-du-neu-ruby-van-con-loi-i.e37b9fea-7b5b-43c8-8af6-cf78a9127596

El directivo de Alpine habló después las sanciones que recibieron los pilotos de la escudería francesa luego del GP de México.

El directivo de Alpine habló después las sanciones que recibieron los pilotos de la escudería francesa luego del GP de México.

Known for its soaring Alpine landscapes and hearty mountain cheeses, Savoie has long attracted travelers seeking a taste of the French Alps—but its burgeoning

Known for its soaring Alpine landscapes and hearty mountain cheeses, Savoie has long attracted travelers seeking a taste of the French Alps—but its burgeoning

Known for its soaring Alpine landscapes and hearty mountain cheeses, Savoie has long attracted travelers seeking a taste of the French Alps—but its burgeoning

This isn’t the New Jersey you think you know.

El Gran Premio de México terminó convirtiéndose en una auténtica decepción para Alpine. La escudería francesa había conseguido colocar a sus dos monoplazas dentro de la zona de puntos después de un…

Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset…