Shadowserver reports over 8,300 internet-facing Gitea instances remain unpatched against CVE-2026-60004, a critical code injection bug already being exploited in the wild. The flaw lets an attacker with repository write access run arbitrary shell commands as the Gitea service account, and since Gitea allows open self-registration by default, unauthenticated users can create an account and repository to gain that access. Gitea patched the issue in version 1.27.1 on July 27, and CISA has added it to its known exploited vulnerabilities list, giving federal agencies just three days to remediate.
bleepingcomputer.com
· 2026-08-28
CISA has added a critical Gitea vulnerability to its Known Exploited Vulnerabilities catalog after confirming attackers are exploiting it in the wild. The flaw, found in the diffpatch API endpoint, lets someone with repository write access run shell commands as the Gitea service account, and since many installations allow open self-registration, even unauthenticated attackers can gain that access simply by signing up and creating a repository. Gitea patched the issue in version 1.27.1 released July 27.
bleepingcomputer.com
· 2026-08-26
Maiao, a command-line tool that recreates Gerrit's stacked-commit review workflow on modern git hosts, has been picked up by community maintainers under runetes/maiao after Adevinta's original team stopped maintaining it. The tool's 'git review' command turns each commit in a branch into its own linked pull or merge request, automatically managing parent-child dependencies and rebasing the stack as changes get merged. It now supports GitHub, GitLab, Gitea, Forgejo/Codeberg, Bitbucket Cloud, and the beta Cursor Origin platform, auto-detecting the provider from the repository's remote URL.
github.com
· 2026-08-25
GoKawiil