CVE-2026-60004: Critical Gitea RCE Exploited to Deploy Miner-Like Payloads

A critical remote code execution vulnerability in Gitea has moved from disclosure to active exploitation less than a month after a patch became available. Tracked as CVE-2026-60004 and rated 9.8 on the CVSS scale, the flaw allows an attacker with ordinary repository write access to plant an executable Git hook and run arbitrary shell commands with the privileges of the Gitea service account. On August 25, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA)…