Reported by 12 outlets

Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Malware

hot0.0

Why this score

Breadth: 2.00 / 2.0 · 12 sources
Authority: 1.80 / 2.0 · best outlet weight
Severity: 5.00 / 5.0 · CVSS + KEV signals
Velocity: 0.00 / 2.0 · updates in 48h
Pickup speed: 0.00 / 0.6 · time to second source
Recency: × 0.00 temporal multiplier
Community: + 0.00 / 1.5 · reddit signal
Score: 0.0 / 10 = base × recency + community

cyberpress.orggithub.commalware.newssecurityweek.combleepingcomputer.comsocprime.comcyberworldops.eurunzero.comgbhackers.commeterpreter.orgsecurebulletin.comcybersecurefox.com CVE-2026-60004 KEV desk first seen 49d ago

Desk analysis

Red Heron, a suspected Chinese-speaking threat actor, weaponized CVE-2026-60004 (CVSS 9.8) within days of public proof-of-concept code emerging in July 2026. The flaw sits in Gitea's diffpatch API: an attacker with repository write access submits a malicious patch that makes Git write an attacker-controlled hook, which executes as the Gitea service account when Git next accesses its index. Because Gitea enables open registration by default, an unauthenticated visitor can register, create a repository, and reach RCE on versions 1.17 through 1.27.0. Gitea fixed it in 1.27.1 on July 27, 2026, and CISA added the CVE to the KEV catalog on August 25 with federal remediation due August 28. Shadowserver later counted over 8,300 unpatched internet-exposed instances.

Acronis Threat Research Unit traced the campaign through Red Heron's own exposed staging server, which held exploitation tools, reconnaissance databases, command history, stolen repositories, and malware. The actor scanned 1,386 Gitea instances across seven countries, kept a separate dataset of 477 Taiwan-based systems categorized by sector including defense, elections, energy, aerospace, telecommunications, government, and research, and confirmed intrusions at 13 organizations in Canada, Argentina, Taiwan, the United States, and Sri Lanka. Stolen data includes proprietary repositories from an industrial automation victim containing SCADA- and HMI-related source code. Post-exploitation went beyond theft: hashcat cracking of Gitea's bcrypt hashes, SSH backdoor keys on a renewable energy firm's server, and lateral movement to root on a three-node Proxmox cluster.

The custom tooling is what elevates this above routine n-day abuse. JITTERLY is a C++ Linux implant with more than 30 capabilities, including remote shell execution, file transfers, interactive terminal sessions, SOCKS tunneling, and internal network pivoting. It deploys SIXZUT, an LD_PRELOAD rootkit installed via /etc/ld.so.preload that hides files, processes, and network connections by intercepting common library functions, blocks termination attempts, and relaunches the agent if its process is killed while the executable remains on disk. That persistence chain makes host-level cleanup unreliable.

Defenders should upgrade to Gitea 1.27.1 or later, disable open registration, and restrict the diffpatch route. Audit accounts created since late July 2026, review logs for unexpected diffpatch requests and Gitea spawning shells, and check /etc/ld.so.preload for libglthread.so.2 from a clean image, since the rootkit filters its own artifacts from live host views. Treat JWT tokens, SSH host keys, and credentials stored in compromised repositories as disclosed and rotate them. If compromise is confirmed, rebuild the server rather than attempt surgical removal.

Timeline

original reporting

Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Malware

cyberpress.org · 28d ago · September 15th, 2026

A Chinese-speaking threat actor tracked as Red Heron has exploited a remote-code-execution vulnerability in Gitea to steal source code, establish persistence, and deploy a previously undocumented Linux rootkit. The campaign weaponized CVE-2026-60004, a CVSS 9.8 flaw in Gitea’s diffpatch functionality, within days of public proof-of-concept code emerging in July. The vulnerability affects Gitea versions 1.17 through 1.27.0 and was fixed in version 1.27.1. Red Heron allegedly scanned 1,386 Gitea instances across seven countries and assembled a separate collection of 477 Taiwan-based systems. Red Heron Hackers Exploit Critical Gitea RCE Recovered reconnaissance data categorized organizations including defense, elections, energy, aerospace, telecommunications, government, and research. Confirmed intrusions involved victims in Canada, Argentina, Taiwan, the United States, and Sri Lanka. The flaw allows a malicious repository patch to cause Git to write an attacker-controlled hook into an active hook directory. When Git later accesses its index, that hook executes under the Gitea service account . Although the diffpatch endpoint requires repository write access, open account registration enabled by default in some deployments allowed attackers to create accounts and repositories before exploitation. Gitea RCE (Source: acronis) After adapting a public GitHub proof of concept, the operators built automation that tested registrations, exploited vulnerable servers, copied repository da
update from github.com

Gitea v1.27.1 release patches CVE-2026-60004

github.com · 78d ago · July 27th, 2026

Gitea released version 1.27.1 on July 27, 2026, with release notes listing the security fix as "Fix: git patch apply" (pull requests #38637 and #38638). The commit was signed by GiteaBot (GPG verified) and authored by lunny (Lunny Xiao) with a verified GitHub signature dated 2026-07-27. The release is the vendor patch for the diffpatch RCE tracked as CVE-2026-60004, which was fixed by changing the temporary clone from bare to non-bare so the repository root no longer serves as $GIT_DIR.
update from malware.news

Gitea security advisory (AV26-845)

malware.news · 49d ago · August 25th, 2026

Serial Number: AV26-845 Date: August 25, 2026 As of August 14, 2026, Gitea is affected by vulnerabilities in the following product: Gitea Prior to 1.27.1 On August 25, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-60004 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
mentioned by securityweek.com

CISA Warns of Exploited Gitea Vulnerability

securityweek.com · 48d ago · August 26th, 2026
update from bleepingcomputer.com

Hackers now exploit critical Gitea flaw in code injection attacks

bleepingcomputer.com · 48d ago · August 26th, 2026

Attackers are actively exploiting a critical-severity vulnerability in the Gitea self-hosted Git service, according to the U.S. Like cloud-hosted GitHub or GitLab SaaS (Software as a Service) platforms, Gitea provides a full suite of DevOps tools, but it is designed to be used as a self-hosted software development platform. Tracked as CVE-2026-60004 and reported by Salesforce security researcher Shai Rod, this code injection security flaw allows an authenticated user with repository write access to repositories hosted on vulnerable servers to execute arbitrary shell commands with the privileges of the Gitea service account by submitting malicious patches via the diffpatch API endpoint. However, default-configured Gitea instances have self-registration enabled, allowing unauthenticated attackers to register an account, create a new repository, and trigger the vulnerability without prior credentials. "With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository." Gitea released version 1.27.1 on July 27 to address CVE-2026-60004 and advised users to upgrade their servers as soon as
update from socprime.com

CVE-2026-60004: Critical Gitea RCE Exploited to Deploy Miner-Like Payloads

socprime.com · 48d ago · August 26th, 2026

A critical remote code execution vulnerability in Gitea has moved from disclosure to active exploitation less than a month after a patch became available. Federal civilian agencies have been instructed to remediate affected installations by August 28, 2026. The issue becomes particularly dangerous because Gitea enables open registration by default. Although exploitation technically requires an authenticated account with repository write permissions, an external attacker may be able to create an account, create a repository, and obtain those privileges without possessing any previously stolen credentials. One publicly reported attack against a vulnerable server resulted in deployment of a dropper exhibiting cryptocurrency-mining behavior. The incident reinforces why the critical Gitea RCE actively exploited in the wild should be treated as an urgent remediation priority for internet-facing self-hosted development infrastructure. CVE-2026-60004 analysis The vulnerability is classified as CWE-94, Improper Control of G
update from bleepingcomputer.com

Over 8,300 Gitea servers vulnerable to code execution attacks

bleepingcomputer.com · 46d ago · August 28th, 2026

Over 8,300 Internet-exposed Gitea instances are still unpatched against a critical security flaw exploited in ongoing remote code execution attacks, according to cybersecurity watchdog Shadowserver. On Friday, Internet security watchdog group Shadowserver warned that nearly 8,400 Gitea servers exposed online are still unsecured
mentioned by cyberworldops.eu

Red Heron exploited CVE-2026-60004, a critical Gitea RCE, to compromise 13 organizations after scanning 1,386 exposed instances. Exposed dev

cyberworldops.eu · 29d ago · September 14th, 2026
update from runzero.com

Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit

runzero.com · 29d ago · September 14th, 2026

The activity progressed from source-code theft to persistent access, credential collection, and lateral movement, including root-level access to a three-node Proxmox cluster. TRU traced a Linux implant to Red Heron’s exposed staging server, revealing the actor’s exploitation tools, reconnaissance databases, command history, stolen repositories, and malware. This provided rare visibility into the operation, from target selection and vulnerability weaponization to post-exploitation activity.
update from gbhackers.com

Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit

gbhackers.com · 28d ago · September 15th, 2026

Researchers from the Acronis Threat Research Unit (TRU) have linked this operation to a newly documented Linux implant called JITTERLY, […] The post Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
update from meterpreter.org

Discover how the Red Heron group exploited a Gitea N-day flaw to steal source code and deploy the stealthy SIXZUT Linux rootkit in a multina

meterpreter.org · 27d ago · September 16th, 2026

Discover how the Red Heron group exploited a Gitea N-day flaw to steal source code and deploy the stealthy SIXZUT Linux rootkit in a multina

via Mastodon https://meterpreter.org/red-heron-gitea-sixzut-rootkit/?utm_source=mastodon&utm_medium=jetpack_social
update from securebulletin.com

Chinese Hacking Crew Weaponizes Critical Gitea Flaw to Hijack Self-Hosted Git Servers Worldwide # CyberSecurity https:// securebulletin.com/

securebulletin.com · 27d ago · September 16th, 2026

Chinese Hacking Crew Weaponizes Critical Gitea Flaw to Hijack Self-Hosted Git Servers Worldwide # CyberSecurity https:// securebulletin.com/

via Mastodon https://securebulletin.com/chinese-hacking-crew-weaponizes-critical-gitea-flaw-to-hijack-self-hosted-git-servers-worldwide/
mentioned by cybersecurefox.com

Red Heron exploits Gitea RCE to attack 13 organizations 🔗 https:// cybersecurefox.com/en/red-hero n-gitea-cve-2026-60004-rce-campaign # Red

cybersecurefox.com · 23d ago · September 20th, 2026
update from cyberpress.org

Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit

cyberpress.org · 17d ago · September 26th, 2026

The operation targeted internet-exposed source-code servers, enabling the theft of proprietary repositories and deployment of the JITTERLY Linux backdoor alongside the stealth-focused SIXZUT rootkit. The post-exploitation chain centers on JITTERLY, a C++ Linux implant that provides operators with more than 30 capabilities, including remote shell execution, file transfers, interactive terminal sessions, SOCKS tunneling, and internal network pivoting. It also decrypts and deploys SIXZUT, an LD_PRELOAD rootkit designed to make the compromise difficult to identify and remove. SIXZUT hides malicious files, processes, and network connections by intercepting commonly used Linux library functions. It can also block termination attempts and relaunch an agent if the process is stopped while its executable remains available on disk. The rootkit relies on /etc/ld.so.preload , making host-level clea
mentioned by gbhackers.com

Red Heron Exploits Critical Gitea Flaw to Steal Repositories and Deploy Linux Rootkit

gbhackers.com · 17d ago · September 26th, 2026
mentioned by gbhackers.com

A critical Gitea flaw is being actively exploited by 'Red Heron' to exfiltrate repositories and deploy a Linux rootkit

gbhackers.com · 17d ago · September 26th, 2026
mentioned by cyberpress.org

Red Heron Exploits CVE-2026-60004 on Gitea Servers to Deploy Linux Rootkit https:// cyberpress.org/red-heron-hack ers-exploit-critical-gitea

cyberpress.org · 15d ago · September 28th, 2026

Covered in

digest 2026-09-29