Self-hosted Gitea servers are under serious attack due to a remote code execution flaw identified as CVE-2026-60004. Researchers say a threat actor known as Red Heron has weaponized this flaw—found in Gitea versions 1.17 through 1.27.0—leveraging it to compromise public-facing source code management setups via automated tools. Gitea released a fix in version 1.27.1 on July 27, 2026. The vulnerability gets a CVSS score of 9.8, placing it in the highest severity tier. It resides in the diffpatch feature used by Gitea, which processes changes in repositories using Git commands. Attackers exploit how Git’s three-way merge handles crafted patches to drop malicious files into the hooks directory. Those hooks then run code with permissions granted to the Gitea service account during index operations.
How Attackers Are Exploiting It
While write access to a repo is required to trigger the vulnerability, many exposed Gitea instances allow open registrations. That creates a path for attackers to create new user accounts, add a repository, submit a specially crafted patch, and trigger the exploit—all without needing stolen credentials. Researchers observed Red Heron scanning more than 1,300 Gitea servers across at least seven countries soon after proof-of-concept exploit code surfaced. Within that, 477 targets in Taiwan were singled out for more focused operations.
Victims have already been identified in Canada, Argentina, Taiwan, the U.S., and Sri Lanka. Once inside, attackers have harvested sensitive data—source code, credentials, database files containing password hashes, configuration secrets, and SSH keys have all been stolen. In one case, renewable-energy organization in Canada saw its internal apps, HR and CRM systems, business APIs, authentication services, and Docker environments breached. Attackers installed persistent access via planted SSH keys. In Taiwan, a Synology NAS incident escalated to root access on a Proxmox cluster, with virtual-machine backups used potentially to siphon full disk images.
Malware & Persistence Details
The campaign makes use of a Linux implant dubbed JITTERLY, which supports a wide range of malicious functions: command execution, file transfers both in and out, network tunneling, interactive terminals, port scanning, reverse port forwarding, and lateral movement across internal networks. It maintains covert communication with a command-and-control server using encrypted TCP channels. Within JITTERLY is a rootkit named SIXZUT, using LD_PRELOAD to hide files, processes, and networking connections. It evades detection by standard Linux monitoring tools, blocks kill attempts, and reactivates automatically if stopped or removed.
What Administrators Must Do
Owners of self-hosted Gitea installations are urged to upgrade to version 1.27.1 or later immediately. Best practices include disabling public registration unless strictly needed, restricting internet-exposed access to Gitea instances, scrutinizing newly created repositories and user accounts, and closely monitoring any diffpatch API calls. If compromise is suspected, treat all stored secrets—SSH keys, tokens, passwords, source code—as compromised and rotate them without delay.
This attack shines a harsh light on how severe flaws in widely used development infrastructure can be exploited rapidly across the globe. Organizations relying on source code management tools must tighten up access controls and monitoring—and treat patches not merely as optional, but as mission-critical defenses.
