Keyword

gitea

2 dispatches · latest 07 SEP 2026 · all keywords →

07 SEP 2026intel

My Homelab Got Hacked: The Forgejo RCE That Took 45 Minutes to Plan and Three Seconds to Pull Off

A homelabber narrates getting pwned by CVE-2026-60004 with receipts — the scanner timeline, the miner hashes, and a public POC repo the attacker clearly cloned.

High severity, 3 of 4. Patch at your next window. Real impact, real exposure.Exploited in the wildCVE-2026-60004

forgejo gitea cve-2026-60004

28 AUG 2026exploits

Gitea's diffpatch Endpoint Turns Any Repo Writer Into Root: Patch It Today, CVE-2026-60004 Is on KEV

A Git hook planted through Gitea's diffpatch endpoint gives unauthenticated attackers RCE as the Gitea service account. ~5,000 instances are exposed and the KEV due date is today.

Critical severity, 4 of 4. Act now — exploited, or trivially exploitable on an exposed service.CVSS 9.8Exploited in the wildKEV due 28 AUG 2026CVE-2026-60004

gitea self-hosted rce