[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2nfnt_1crfMzyRfxwRzREloFwp4h52y62tUmopVAcYw":3},{"article":4,"iocs":54,"watch_terms":65,"solutions":66,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"36c6d7b0-6f37-43e9-ab9f-f97ca5dd19dd","Over 8,300 Gitea servers vulnerable to code execution attacks","over-8-300-gitea-servers-vulnerable-to-code-execution-attacks-5688b3","Over 8,300 Internet-exposed Gitea instances are still unpatched against a critical security flaw exploited in ongoing remote code execution attacks, according to cybersecurity watchdog Shadowserver. [...]","Over 8,300 internet-exposed Gitea instances are still vulnerable to remote code execution attacks due to an unpatched critical security flaw (CVE-2026-60004). The vulnerability allows authenticated attackers to execute arbitrary shell commands, and with default open registration, unauthenticated attackers can exploit it by creating an account and a repository. Attackers are reportedly deploying cryptocurrency mining malware on compromised servers.","Over 8,300 Gitea servers remain unpatched against a critical code execution vulnerability.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fover-8-300-gitea-servers-vulnerable-to-code-execution-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F28\u002FGitea.jpg","2026-08-28T12:58:43+00:00","2026-08-28T14:00:12.124203+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"Gitea","product",{"name":21,"type":22},"Salesforce","vendor",{"name":24,"type":19},"Docker",{"name":26,"type":19},"GitHub",{"name":28,"type":19},"GitLab",{"name":30,"type":19},"Bitbucket","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62],{"type":56,"value":57,"context":58},"cve","CVE-2026-60004","Critical code injection vulnerability in Gitea.",{"type":56,"value":60,"context":61},"CVE-2026-20896","Authentication bypass vulnerability in Gitea Docker image.",{"type":48,"value":63,"context":64},"cryptocurrency mining malware","Malware deployed on unpatched Gitea servers.",[21,18,24],{"controls":67,"vendors":155},[68,97,126],{"slug":69,"name":70,"problem":71,"products":72},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":98,"name":99,"problem":100,"products":101},"patch-management","Automated patch management","Known holes get closed in days, not months.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":127,"name":128,"problem":129,"products":130},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[],{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":174},"8300-gitea-servers-exposed-to-rce-due-to-unpatched-critical-flaw","8,300+ Gitea Servers Exposed to RCE Due to Unpatched Critical Flaw","Over 8,300 internet-facing Gitea servers remain unpatched against CVE-2026-60004, a critical remote code execution vulnerability that allows authenticated attackers to execute arbitrary shell commands. The risk is compounded by Gitea's default open registration setting, which effectively removes the 'authenticated' barrier and allows anyone on the internet to exploit the flaw without prior credentials. This combination of a delayed patching posture and a permissive default configuration is enabling active cryptomining campaigns against compromised servers. The incident underscores that exposing unpatched, publicly reachable developer infrastructure is a high-risk practice, as code repositories often hold sensitive secrets, source code, and pipeline credentials that can cascade into broader supply chain compromises.",[161,162,163,164,165,166,167,168,169,170,171,172,173],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SI-2: Flaw Remediation","NIST CM-6: Configuration Settings","NIST AC-2: Account Management","NIST RA-5: Vulnerability Monitoring and Scanning","ITIL: Change and Release Management (emergency change procedures)","OWASP Top 10 A05:2021 – Security Misconfiguration","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 32: Security of Processing",{}]