open source security

3 articles · newest first

Rows of server racks in a data center, representative of the self-hosted infrastructure Gitea instances typically run on

a Gitea admin's hosting bill flagged 70% CPU usage. that's how he found the hackers

A bug that lets anyone with a free account plant a git hook is now CISA's problem — and it started with a cryptominer, not a headline.

Priya Nair · Aug 26 · 6 min

A terminal window showing Git commands on a dark background, representing a self-hosted Git server

Software

Gogs has a history of sitting on RCE bugs. this time, someone actually fixed it

Two critical bugs let anyone overwrite Git hooks and run code on your server — and for once, the fix shipped before it turned into the usual Gogs mess.

Priya Nair · Aug 25 · 6 min

A developer's screen showing a git diff and terminal window side by side

Software

your newest Gitea contributor might already have a shell on your server

A patch, a diff, and a Git hook was all it took — no admin access required, and Gitea's own advisory shipped with working exploit code attached.

Priya Nair · Aug 3 · 6 min