Hackers are actively exploiting a critical Gitea remote code execution vulnerability, tracked as CVE-2026-60004, to compromise internet-facing source-code management servers.
Researchers found that a Chinese-speaking threat actor, named Red Heron, quickly turned public exploit code into an automated attack framework that stole source code, collected credentials, installed backdoors, and moved deeper into victim networks.
The flaw affects Gitea versions 1.17 through 1.27.0 and has a CVSS severity score of 9.8. Gitea fixed the issue in version 1.27.1, released on July 27, 2026. The vulnerability exists in Gitea’s diffpatch feature, which processes repository patches using Git commands.
The exploit abuses Git’s three-way merge behavior to write a malicious file into the repository hook directory. When Git later performs an index-related action, the malicious hook executes commands with the permissions of the Gitea service account. This gives attackers remote code execution on the vulnerable server.
Hackers Exploiting Gitea n-day RCE Vulnerability
Although exploitation requires write access to a repository, many exposed Gitea deployments allow users to register new accounts. Attackers can abuse this setting by creating an account, opening a repository, submitting a crafted patch, and triggering the flaw without needing stolen credentials.
Acronis Threat Research Unit discovered that Red Heron scanned 1,386 Gitea servers across seven countries shortly after the public proof-of-concept became available. The group also maintained a separate list of 477 Taiwan-based targets.
Its records categorized organizations using Simplified Chinese labels for sectors including defense, elections, energy, aerospace, telecommunications, government, research, cloud services, and developer tooling.
Researchers identified confirmed victim activity in Canada, Argentina, Taiwan, the United States, and Sri Lanka. The attackers used automated tools to register accounts, exploit targets, download repositories, and remove selected traces from Gitea databases.
In several cases, the attackers stole database files containing password hashes and configuration data that could expose application secrets, internal tokens, and SSH keys.
One compromised renewable-energy organization in Canada suffered extensive intrusion activity. The attackers reportedly accessed source code, internal applications, HR and CRM systems, authentication services, business APIs, and Docker network information. They also planted SSH keys for persistent access and collected configuration secrets from the environment.
The campaign also targeted a Taiwanese environment hosted on a Synology NAS. From the initial Gitea compromise, Red Heron obtained a Proxmox root authentication ticket and gained administrative access to a three-node Proxmox cluster.
The attackers uploaded payloads to multiple nodes and initiated virtual-machine backup operations, which could have enabled the theft of complete VM disk images rather than only source repositories.
Researchers also linked the activity to a Linux implant named JITTERLY. The malware supports command execution, file uploads and downloads, network tunneling, interactive terminal sessions, port scanning, reverse port forwarding, and internal network pivoting.
JITTERLY communicates with its command-and-control server over raw TCP using encrypted messages. JITTERLY contains an embedded LD_PRELOAD rootkit called SIXZUT.
The rootkit can hide malicious files, processes, and network connections from common Linux monitoring tools. It can also block attempts to terminate the implant and relaunch it when it is removed or stopped.
Organizations running self-hosted Gitea should upgrade to version 1.27.1 or later immediately. Administrators should turn off open registration when it is not required, restrict access to internet-facing Gitea instances, review newly created accounts and repositories, and investigate unexpected requests to diffpatch endpoints.
Treat any secrets stored on a compromised Gitea server, including tokens, passwords, SSH keys, and source code, as exposed and rotate them.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post Hackers Actively Exploiting Gitea n-day RCE Vulnerability in the Wild to Hijack Instances appeared first on Cyber Security News.