60
55
60
Hackers Actively Exploiting Gitea n-day RCE Vulnerability in the Wild to Hijack Instances
Chinese-speaking Red Heron actors mass-exploit Gitea n-day RCE CVE-2026-60004 to steal source code, credentials, and pivot into victim networks.
Acronis Threat Research Unit reports active in-the-wild exploitation of Gitea RCE CVE-2026-60004 (CVSS 9.8, versions 1.17-1.27.0, fixed in 1.27.1) by a Chinese-speaking actor dubbed Red Heron. The actor scanned 1,386 Gitea servers across seven countries, held a separate list of 477 Taiwan-based targets, and confirmed victims in Canada, Argentina, Taiwan, the US, and Sri Lanka. Intrusions deployed the JITTERLY Linux implant with the SIXZUT LD_PRELOAD rootkit, stole password hashes and SSH keys, and in one case gained root admin access to a three-node Proxmox cluster.
80
60
60
60
55
60
60
Russian Hackers Exploit Safari and Chrome Flaws in High
60
60
60
60
60
60
60
60
60
CLOP targets Gladinet CentreStack servers in large
60
60
60
60
60
60
60
55
Critical Fortinet FortiOS flaw exploited in the wild (CVE-2024-21762)
60
Fortinet Warns of Critical FortiOS SSL VPN Flaw Likely Under Active Exploitation
60
60
60
60
60
In 2022, more than 40% of zero-day exploits used in the wild were variations of previous issues
60
60
60
60
60
60
55