700+ self-hosted Gits battered in 0-day attacks with no fix imminent

Wiz researchers disclosed a zero-day (CVE-2025-8110) in Gogs (<=0.13.3) that bypasses a previous patch by abusing symbolic links and the PutContents API to overwrite files outside repos, enabling remote code execution; over 700 of ~1,400 internet-exposed Gogs instances were confirmed compromised with Supershell C2 payloads. Researchers recommend disabling open registration and restricting internet exposure, and published IOCs to detect exploitation.