Overview
- CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to install the late-July patch by August 28, a move announced Wednesday to force rapid remediation.
- The bug is a code-injection remote‑code‑execution flaw in Gitea’s diffpatch API that lets an account with repository write access plant an executable Git hook and run shell commands as the Gitea service user.
- Gitea fixed the vulnerability in version 1.27.1 and the flaw affects releases going back to 1.17, so operators running older versions must update or remain exposed.
- A developer reported a real-world attack that used the flaw to drop a miner-like payload that caused sustained high CPU use and performed actions typical of cryptojacking such as clearing library preload variables, killing competing processes, fetching architecture‑specific binaries, and deleting files after execution.
- Public details remain limited: investigators have not published full technical indicators or identified operators, and the incident follows other recent exploited Gitea flaws, underlining risk to self-hosted instances that keep default open registration and weak access controls.