Attackers Exploited Gogs Zero-Day Flaw for Months

# Executive Summary Wiz disclosed CVE-2025-8110, a remote code execution flaw in Gogs that bypasses a prior path-validation fix through symbolic link abuse; attackers can write outside the repository via the PutContents API, enabling file overwrite and code execution. Active, automated "smash-and-grab" exploitation began July 10, with Wiz finding ~1,400 internet-exposed instances and more than 700 compromised (patterns include random 8-character repo names and unexpected PutContents calls), Supershell seen on infected hosts, and no patch available—mitigations include disabling open registration, reducing internet exposure, and monitoring for the described IOCs.