gitea

3 articles · newest first

a Gitea admin's hosting bill flagged 70% CPU usage. that's how he found the hackers

A bug that lets anyone with a free account plant a git hook is now CISA's problem — and it started with a cryptominer, not a headline.

Priya Nair · Aug 26 · 6 min

A developer terminal displaying a git repository, representing self-hosted Gitea instances affected by CVE-2026-59774

Software

self-hosting Gitea? a stranger can read your server's secrets without logging in — patch today

A single #+INCLUDE line in a Gitea markup preview is enough for an anonymous visitor to pull your server's config file straight off disk, and from there, the path to running their own code is depressingly short.

Priya Nair · Aug 6 · 7 min

A developer's screen showing a git diff and terminal window side by side

Software

your newest Gitea contributor might already have a shell on your server

A patch, a diff, and a Git hook was all it took — no admin access required, and Gitea's own advisory shipped with working exploit code attached.

Priya Nair · Aug 3 · 6 min