More than 575 malicious OpenClaw skills delivered malware
Acronis also describes an AI-agent operator, next-day exploitation of a patched Gitea flaw, and ransomware that removes recovery data.
3
Stories per day · 30 days
3 RSS
16 stories, newest first · one card per story
Stories tagged #gitea
Critical Gitea Vulnerabilities Allow Attackers to Bypass Authentication and Execute Code
Gitea 28.0.0 patches 20 flaws, including SSH impersonation, workflow approval bypasses, and SSRF.
12
Gitea Patches 27 Security Flaws, Including Critical SSH Authentication Bypass and SSRF
Gitea 28.0.0 and 28.1.0 patch 27 flaws, including a CVSS 9.1 SSH authentication bypass.
8
Gitea 28.0
Gitea 28.0 adds audit logs and bot accounts, withholding security-fix details for about a week.
Red Heron Exploits Critical Gitea Flaw to Steal Repositories and Deploy Linux Rootkit
Red Heron exploited Gitea CVE-2026-60004 to steal repositories and deploy the JITTERLY backdoor and SIXZUT rootkit.
Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit
PRC-linked Red Heron exploits critical Gitea RCE CVE-2026-60004 to steal source code and deploy JITTERLY implant with SIXZUT LD_PRELOAD rootkit; victims span five countries.
Hackers Actively Exploiting Gitea n-day RCE Vulnerability in the Wild to Hijack Instances
Chinese-speaking Red Heron actors mass-exploit Gitea n-day RCE CVE-2026-60004 to steal source code, credentials, and pivot into victim networks.
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
China-linked Red Heron exploited Gitea RCE CVE-2026-60004 to compromise 13 organizations across six countries, stealing source code.
Bulk AbuseIPDB reporting using command-line tools
A blogger shows how to bulk-report distributed botnet IPs scraping a self-hosted Gitea instance to AbuseIPDB using bash, awk, and jq.
Emerging Threat: (CVE-2026-60004) Gitea Remote Code Execution via ...
CVE-2026-60004 (CVSS 9.8) lets attackers with repository write access achieve RCE on self-hosted Gitea servers via malicious git hooks; fixed in 1.27.1.
15
Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited
Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.
Over 8,300 Gitea servers vulnerable to code execution attacks
Over 8,300 internet-facing Gitea servers are exposed to active exploitation of CVE-2026-60004, an authenticated code injection flaw enabling arbitrary code execution.
5
U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog
CISA added the actively exploited Gitea RCE flaw CVE-2026-60004 (CVSS 9.8) to its KEV catalog, with federal patching due by August 28, 2026.
3
Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner
CISA added actively exploited Gitea RCE CVE-2026-60004 (CVSS 9.8) to the KEV catalog as attackers deploy a cryptojacking dropper.
3
Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)
Attackers are actively exploiting critical Gitea RCE CVE-2026-60004 via the diffpatch endpoint, prompting CISA KEV addition and at least one cryptomining compromise.
4
Gitea security advisory (AV26-845)
CISA added CVE-2026-60004, an actively exploited RCE via diffpatch Git hook installation in Gitea, to the KEV catalog; users should upgrade past 1.27.1.