CISA says attackers are exploiting a critical Gitea code-injection flaw

CISA says CVE-2026-60004 is being exploited on self-hosted Gitea: a critical code injection in the diffpatch API. Default open registration lets an unauthenticated visitor create an account and repository, then run commands as the gitea user.

Image published with BleepingComputer on exploited Gitea CVE-2026-60004

On August 26, 2026 BleepingComputer reported that attackers are exploiting a critical Gitea flaw that CISA has now flagged.

What we know

CISA says CVE-2026-60004 is being exploited on self-hosted Gitea as a critical code injection in the diffpatch API.
Default open registration lets an unauthenticated visitor create an account and repository, then run commands as the gitea user.
The flaw was fixed in Gitea 1.27.1 on July 27 after a report by Salesforce’s Shai Rod.
Federal civilian agencies have a patch deadline of August 28 under BOD 26-04.
Shadowserver has seen about 5,000 exposed instances; some attacks deployed cryptocurrency miners.

Takeaways

Open registration turns an unauthenticated visitor into a command-running gitea user.
The fix shipped in 1.27.1 on July 27; CISA now wants civilian agencies patched by August 28.
Thousands of instances are still exposed, and some exploitation has dropped miners.

Source: BleepingComputer / CISA

Related reading

Image published with SiliconANGLE on the Nvidia NemoClaw CVE-2026-65105 flaw

SecurityAug 253 min read

NemoClaw flaw let a malicious site poison a developer’s local Ollama model

Oasis Security’s CVE-2026-65105 says one visit to a malicious site can take control of the local Ollama instance behind Nvidia’s NemoClaw agent. Ollama binds on 0.0.0.0:11434, and the Host check is skipped when the bind address is not loopback.

Image published with BleepingComputer on npm and UNPKG phishing pages

SecurityAug 253 min read

Attackers abuse npm and UNPKG to host phishing redirect pages

OX Security found 24 npm packages that contain only malicious HTML impersonating a Cloudflare Turnstile check. UNPKG copied the files, so opening the HTML from the trusted mirror can redirect a visitor.

Image published with BleepingComputer on the DDoS against Norway’s Digdir services

SecurityAug 253 min read

DDoS disrupts Norway’s government login and e-signing services

A DDoS starting at 03:38 CEST Monday hit infrastructure run by Digdir and Vivicta, leaving ID-porten and eSignering partly inaccessible. Digdir director Frode Danielsen said there was no breach and no personal-data compromise.

All of Pulse

SecurityAugust 26, 20263 min read

CISA says attackers are exploiting a critical Gitea code-injection flaw

On August 26, 2026 BleepingComputer reported that attackers are exploiting a critical Gitea flaw that CISA has now flagged.

What we know

CISA says CVE-2026-60004 is being exploited on self-hosted Gitea as a critical code injection in the diffpatch API.
Default open registration lets an unauthenticated visitor create an account and repository, then run commands as the gitea user.
The flaw was fixed in Gitea 1.27.1 on July 27 after a report by Salesforce’s Shai Rod.
Federal civilian agencies have a patch deadline of August 28 under BOD 26-04.
Shadowserver has seen about 5,000 exposed instances; some attacks deployed cryptocurrency miners.

Takeaways

Open registration turns an unauthenticated visitor into a command-running gitea user.
The fix shipped in 1.27.1 on July 27; CISA now wants civilian agencies patched by August 28.
Thousands of instances are still exposed, and some exploitation has dropped miners.

Source: BleepingComputer / CISA