Cybercriminals are currently exploiting a severe remote code execution (RCE) vulnerability in Gitea, a popular source-code management service. Known as CVE-2026-60004, this flaw is being used to compromise servers that are accessible via the internet.
Details of the Exploit
A group of Chinese-speaking hackers, identified as Red Heron, have rapidly developed an automated attack framework from public exploit code. This framework allows them to steal source code, harvest credentials, install backdoors, and further infiltrate networks of affected organizations.
The vulnerability impacts Gitea versions 1.17 to 1.27.0, earning a critical Common Vulnerability Scoring System (CVSS) score of 9.8. A patch was issued with version 1.27.1 on July 27, 2026, resolving the issue linked to Gitea’s diffpatch feature, which processes repository patches using Git commands.
Mechanics of the Attack
The attack exploits the Git three-way merge function to introduce a malicious file into the repository’s hook directory. This enables the execution of harmful commands with the Gitea service account privileges whenever Git performs an index operation. Although attackers need write access to a repository, numerous exposed Gitea setups permit new user registrations, allowing malicious actors to exploit the vulnerability without needing existing credentials.
The Acronis Threat Research Unit revealed that Red Heron scanned over 1,386 Gitea servers across seven countries shortly after the proof-of-concept was released, including a separate focus on 477 servers in Taiwan. This group categorizes its targets using Simplified Chinese terms for various sectors, such as defense, energy, and telecommunications.
Impact and Recommendations
Confirmed attacks have been observed in countries like Canada, Argentina, Taiwan, the United States, and Sri Lanka. Hackers have automated the process of account registration, target exploitation, repository downloading, and trace removal from affected databases.
One notable breach involved a Canadian renewable-energy company where attackers accessed a wide range of sensitive data and systems. Similarly, Taiwanese servers hosted on Synology NAS were targeted, and attackers gained significant control over Proxmox clusters, potentially enabling the theft of entire virtual machine disk images.
Researchers have connected these activities to a Linux malware named JITTERLY, which offers various malicious capabilities, including command execution and network pivoting, while using an embedded rootkit called SIXZUT to evade detection.
Organizations using self-hosted Gitea are advised to update to version 1.27.1 or later promptly, disable open registration unless necessary, limit access to internet-facing instances, and closely monitor new accounts and repositories. Additionally, it is crucial to treat any stored secrets as compromised and rotate them accordingly.
