Hackers Actively Exploiting Gitea n-day RCE Vulnerability in the Wild to Hijack Instances
Chinese-speaking Red Heron actors mass-exploit Gitea n-day RCE CVE-2026-60004 to steal source code, credentials, and pivot into victim networks.
Acronis Threat Research Unit reports active in-the-wild exploitation of Gitea RCE CVE-2026-60004 (CVSS 9.8, versions 1.17-1.27.0, fixed in 1.27.1) by a Chinese-speaking actor dubbed Red Heron. The actor scanned 1,386 Gitea servers across seven countries, held a separate list of 477 Taiwan-based targets, and confirmed victims in Canada, Argentina, Taiwan, the US, and Sri Lanka. Intrusions deployed the JITTERLY Linux implant with the SIXZUT LD_PRELOAD rootkit, stole password hashes and SSH keys, and in one case gained root admin access to a three-node Proxmox cluster.
- CVE-2026-60004 (CVSS 9.8) actively exploited; Gitea fixed in 1.27.1 released July 27, 2026
- Red Heron automated account registration, exploitation, repo theft, and log cleanup
- JITTERLY implant bundles SIXZUT LD_PRELOAD rootkit hiding files, processes, connections
- Victims span Canada, Argentina, Taiwan, US, Sri Lanka including energy and government sectors
- All secrets on compromised Gitea servers (tokens, SSH keys, source) should be rotated
- CVEs
- CVE-2026-60004
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-60004 | Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection | 9.8 | 24% | KEVPoC ×4 | KEV |
From the original article
3 min read at cybersecuritynews.com
Hackers are actively exploiting a critical Gitea remote code execution vulnerability, tracked as CVE-2026-60004, to compromise internet-facing source-code management servers.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.