If your company hosts its own source code rather than keeping it on GitHub, there is a decent chance it runs Gitea. On August 25 the US Cybersecurity and Infrastructure Security Agency added a code injection flaw in that software to its Known Exploited Vulnerabilities catalog, which it only does when it has evidence somebody is already using the bug in real attacks.
The flaw is CVE-2026-60004. According to the catalog entry, an attacker who already has write access to a repository can send a malicious patch to the diffpatch API endpoint, plant an executable Git hook, and run shell commands as the Gitea service account. A Git hook is a script the server runs automatically when something happens to a repository, such as a push, so a hook the attacker controls is a command prompt on the machine that stores everyone's code.
Write access is a lower bar than it sounds
This is not a flaw a stranger can fire at your login page. It needs an account that can already commit somewhere. That sounds reassuring until you count the ways that access gets handed out: a contractor's account, a personal access token pasted into a CI job, a stale contributor nobody removed, or a developer laptop with a stealer on it. Push rights on one unimportant repository become shell on the server hosting all the rest.
CISA's alert is short and says nothing beyond the listing itself. It does not name who is exploiting the flaw, how many organizations are affected, or when the activity started, and the entry carries no severity score. That is normal for a catalog addition, and it is all the agency has published, so treat anything more specific with suspicion until the project or a research team fills it in.
What the federal deadline actually requires
Binding Operational Directive 26-04 sets the rules for federal civilian agencies, and it changed the shape of this obligation earlier this year. Agencies now have to prioritize rapid remediation of catalog-listed flaws on publicly exposed assets that would grant an attacker total control of the asset, while deferring lower risk items, and they must check whether attackers got in before the patch went on. CISA encourages every other organization to work the same way, which is the sensible reading here: an internet-facing Git server that holds your build pipeline is exactly the asset the directive is describing. We covered a similar addition earlier this week when a maximum severity Oracle HTTP Server flaw landed in the same catalog.
Update Gitea, then go looking for hooks
Move to the latest Gitea release and follow the project's own security releases for the fixed version, which CISA's catalog addition does not spell out. If the description holds, the artifact worth hunting for afterwards is an executable hook nobody remembers adding, in any repository, along with unexpected shell activity from the account Gitea runs as. Reviewing who actually holds write access is worth an hour of somebody's week regardless, and the same instinct applies to any self-hosted development platform, as a GitLab flaw that let strangers delete public projects showed last week.
Source hosting keeps drawing this kind of attention for an obvious reason. It is the one system in most companies that touches every other one.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.