What happened. Alpine Linux, a security-focused Linux distribution, says an unknown attacker went after its unpatched GitLab server on Oct 20 and 21 by sending crafted CI pipeline settings. That crashed GitLab's worker processes eight times, and in four of those the exploit failed only at the next step. The attacker also downloaded Alpine's GitLab container image, and tried again on Oct 25 and 26 but was blocked. Alpine says it found no proof the attack worked, treated the server as compromised anyway and rebuilt it. It says its package repository and Oct 21 releases weren't tampered with.
Why it matters. A self-hosted GitLab server holds a company's source code, build pipelines and the secrets those pipelines use. An attacker who can run code there can poison software before it ships. The way in here was CI configuration, which on many servers any project member can edit. Cisco has confirmed attacks on the firewall bug added the same day but hasn't said who was hit.
What I'd do today. Patch self-hosted GitLab now rather than waiting for the Nov 1 federal deadline. Look in GitLab logs for repeated worker crashes since Oct 20, which is what Alpine saw. Limit who can create projects or edit CI settings on internet-facing servers, and if you find crashes you can't explain, rotate the CI runner tokens and secrets stored in the server.