Over 8,300 Gitea servers vulnerable to code execution attacks

A critical Gitea code-injection vulnerability (CVE-2026-60004) is being actively exploited in the wild: attackers can submit malicious patches via the diffpatch endpoint to run arbitrary shell commands as the Gitea service user. Shadowserver reported ~8,393 exposed, unpatched instances; attackers have been observed deploying cryptocurrency-mining malware, and CISA has added the flaw to its catalog of actively exploited vulnerabilities and ordered urgent patching.