Hackers exploit unpatched Gogs zero-day to breach 700 servers

An actively exploited zero-day in Gogs (CVE-2025-8110) allows remote code execution by abusing symbolic links in the PutContents API to perform path traversal and overwrite system files; Wiz Research found over 1,400 internet-exposed Gogs instances with more than 700 showing compromise, observed repositories with random 8-character names, and Supershell-based malware communicating with C2 119.45.176.196. Administrators are advised to disable open registration, restrict access via VPN or allow lists, and check for suspicious PutContents API activity and random repositories.