Attackers used a maximum-severity GitLab bug against the Alpine Linux project, and CISA has now listed it as exploited.