Internet threat monitoring telemetry indicates that over 8,300 self-hosted developer repository servers remain exposed to active remote code execution attacks as the federal remediation deadline arrives. Threat actors are actively exploiting a diffpatch API vulnerability to plant malicious execution hooks and drop cryptomining payloads.
The vulnerability, tracked as CVE-2026-60004, impacts Gitea instances prior to version 1.27.1. The flaw resides within the diffpatch API endpoint handling patch-format submissions to repository trees. An authenticated user, or an anonymous visitor on instances featuring default open registration, can submit crafted patch data to install custom Git hooks. When executed, these hooks run system commands with Gitea service privileges. CISA mandated federal agency remediation by August 28 under Binding Operational Directive 26-04 following verified wild exploitation.
Subverting self-hosted developer repositories introduces severe software supply chain exposure across enterprise build systems. Armed with execution access on Git servers, threat actors can steal proprietary source code, capture CI/CD access tokens, and inject malicious dependencies into production release builds.
– Force immediate software maintenance upgrades across all Gitea instances to release version 1.27.2 or higher.
– Disable open registration settings and enforce strict user invitation controls across all self-hosted repository portals.
– Inspect host process telemetry for anomalous process spawns or cryptomining daemons executing under Gitea service accounts.
– Audit repository hook directories for unrecognized executable files or unexpected diffpatch modification entries.
Developer forge protection depends on strict API input sanitization and prompt patch installation to guarantee self-hosted source control platforms remain completely protected from code injection payloads. #CodeDefence #Gitea #SupplyChain #CodeInjection #RCE #DevSecOps #CISA #KEV
/
