55
60
55
60
60
60
60
55
60
60
55
55
55
60
55
55
55
55
60
60
60
60
60
55
60
55
55
IT threat evolution Q2 2022
60
60
60
60
60
Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)
Attackers are actively exploiting critical Gitea RCE CVE-2026-60004 via the diffpatch endpoint, prompting CISA KEV addition and at least one cryptomining compromise.
CISA added CVE-2026-60004, a critical code injection flaw in Gitea's diffpatch endpoint, to its Known Exploited Vulnerabilities catalog after in-the-wild attacks. An attacker with repository write access, or an unauthenticated visitor on instances with open registration, can execute arbitrary shell commands as the Gitea OS user. A disclosed incident saw an automated scanner register an account and deploy a loader and cryptominer inside a Docker container within about 11 seconds, with no persistence mechanism found. Gitea patched the flaw in v1.27.1, and CISA ordered US federal civilian agencies to update by August 28, 2026.
80
⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply
60
55
55
60
60
60
60