Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Self-hosted Gitea instances
Incident: Active exploitation of a critical RCE vulnerability in Gitea servers.
Impact: Full remote code execution as the Gitea service account, leading to system compromise and cryptomining payload deployment.
Attacker: Unidentified threat actors
Analysis: Attackers are leveraging CVE-2026-60004 to execute arbitrary shell commands via the diffpatch endpoint. The vulnerability is especially potent when open registration is enabled, as it allows any external actor to gain the required write access to a repository. CISA has officially added this flaw to its Known Exploited Vulnerabilities catalog due to active exploitation.
Recommendations: Update Gitea instances to version 1.27.1 or later immediately.; Disable open registration by setting DISABLE_REGISTRATION to true.; Monitor server resource usage for unusual CPU spikes indicative of cryptomining.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source