Critical Security Flaw in Popular Code Management Tool Puts Thousands of Servers at Risk

A Major Security Problem Discovered

Gitea, a self-hosted platform that helps teams manage and store their computer code, has been found to contain a serious security weakness. The flaw is dangerous enough that attackers can use it to take control of servers running this software and execute whatever commands they want. Security researchers have already discovered traces of harmful software called Flying Eagle Android RAT on over 170 computers worldwide, suggesting that criminals are actively exploiting this vulnerability right now.

The problem was assigned the identifier CVE-2026-60004 and received a severity rating of 9 out of 10 — placing it in the highest danger category. What makes this particularly concerning is how easy it is to exploit. An attacker doesn't need sophisticated hacking skills or special access; they simply need permission to make changes to code within the system, which is something many legitimate team members have.

How the Attack Works

Think of Gitea like a digital library where teams store their software blueprints. The vulnerability works like this: an attacker with basic write permissions can sneak malicious instructions into something called a "patch" — essentially a set of changes to code. The system then automatically converts these changes into what's called a "Git hook," which is like an automatic trigger that runs whenever certain actions happen. Once activated, these hooks execute as the service account, meaning the attacker gains the same powerful permissions that the Gitea program itself has on that server.

To use another analogy, imagine a trusted employee at a bank who can submit routine paperwork. If that employee slips malicious instructions into their paperwork and those instructions automatically execute with the bank manager's authority, that's similar to what's happening here.

Why This Matters for Your Organization

If your company uses Gitea to manage its code, this vulnerability is a direct threat to your security. An insider with basic permissions — or an outsider who gains such permissions through other means — could potentially:

• Steal sensitive source code and business secrets
• Plant malicious code into legitimate software projects
• Disrupt your entire development pipeline
• Compromise other connected systems on your network

The fact that harmful software is already being found on hundreds of servers worldwide means this isn't a theoretical problem — it's actively being exploited.

What You Should Do Right Now

If your organization runs Gitea, take these steps immediately:

• Apply the security patch — The development team has released a fix, so update your installation without delay
• Review access permissions — Audit who has the ability to write code or make changes, and remove access where unnecessary
• Scan your systems — Check your servers for signs of the Flying Eagle malware or other suspicious activity
• Monitor activity logs — Look for unusual patch submissions or hook executions that might indicate someone exploited this flaw

Looking Forward

This incident reminds us that even tools designed to protect our code can become security risks if vulnerabilities aren't patched quickly. The combination of an easy-to-exploit flaw and active criminal exploitation makes this one of the more urgent security issues facing development teams today.

Organizations should prioritize this update with the same urgency they'd give to any critical security incident.