Gitea GHSA-rcr6-4jqh-j84m / CVE-2026-60004 (28 July 2026 advisory; CISA KEV 25 August 2026): diffpatch API can let a user with repository write access (including self-registered users on open instances) run commands as the Gitea service account. Affected 1.17 through versions before 1.27.1; patch to 1.27.1+.

UPDATE 14 September 2026: Acronis Threat Research Unit (13 September) assesses with moderate confidence that a cluster it tracks as Red Heron operates within a PRC-linked context; it began building on a public CVE-2026-60004 PoC on 29 July 2026, scanning 1,386 Gitea instances across seven countries (plus a 477-instance Taiwan dataset).

Acronis says confirmed compromises affected organisations in Canada, Argentina, Taiwan, the United States and Sri Lanka, and a Qatar-based target also had data pulled. Campaign progressed from repository theft to credentials, persistence, and lateral movement (including root on a three-node Proxmox cluster). Tooling includes C++ Linux implant JITTERLY (30+ commands) and LD_PRELOAD rootkit SIXZUT. (sources: Gitea; CISA; Acronis TRU)

Correction (29 Oct 2026): CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog on 25 August 2026; CISA's alert and catalog entry are now linked, as is Acronis TRU's own report (13 Sep 2026); internal source labels were removed. (sources: CISA; Acronis)

Correction (29 Oct 2026): an earlier version gave a figure of 13 compromised organisations; no linked source on this card gives that figure. (source: Acronis TRU)

Correction (29 Oct 2026): the card date is now 13 September 2026, the date shown on Acronis Threat Research Unit's report, the earliest readable source reporting the Red Heron exploitation this card is about; Gitea's 28 July 2026 advisory is background on the flaw and no longer sets the date. The card had been dated 25 August 2026, the day CISA added the flaw to its Known Exploited Vulnerabilities catalog. (source: Acronis TRU)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Acronis TRU)