The Patch is Live. The Miners are Already In.

# The Patch is Live. The Miners are Already In. Your pager goes off at 3am because your build server is screaming. CPU usage is pegged at 98 percent across all cores. You check the process list and find a binary you don't recognize running out of /tmp, chewing through cycles to mine Monero. This is how CVE-2026-60004 starts. It's a code injection vulnerability in Gitea. For those who didn't spend their career in the SOC, Gitea is a lightweight, self-hosted Git service. It's the go-to for teams that want GitHub functionality without handing their intellectual property over to a third party or paying for a GitLab enterprise license. The flaw allows an attacker to inject and execute arbitrary code on the server. In plain terms: if you're running Gitea, someone can send a specifically crafted request to your instance and tell it to run any command they want. No fancy credentials required. Just a direct line from the internet to your shell. CISA added this to the Known Exploited Vulnerabilities (KEV) list on August 25. The federal patch deadline was August 28. Today is August 30. If you haven't updated, you're already late and likely already compromised. Vendor severity ratings usually lag behind reality. They call things "critical" once the exploits are public and the damage is done. I don't trust a vendor's rating until I see the payloads hitting the wild. In this case, we're seeing miner-like payloads. Some admins think miners are a nuisance. They aren't. A crypto-miner is a beachhead. It proves the RCE works and that the environment is permissive enough to execute binaries and maintain outbound connections. Once the miner is running, the attackers have a foothold. The pivot from "mining some coins" to "stealing the crown jewels" takes minutes, not days. The argument I hear most often is that Gitea is tucked away behind a VPN or restricted to an internal subnet. This is a failure of imagination. We've seen this before with things like CVE-2026-8452 in NetScaler. Attackers don't just knock on the front door; they find a way through a forgotten dev box or a compromised workstation and then move laterally. Once they are inside your perimeter, an unpatched Gitea server is a gift. It's a central hub of credentials and secrets. That brings us to the second-order effect: the supply chain. Gitea doesn't just hold code. It holds SSH keys, deployment tokens, and CI/CD configurations. If an attacker pops your Gitea instance via CVE-2026-60004, they aren't just stealing your source code. They are stealing the keys to your production environment. Two steps downstream from the Gitea server is every single customer using the software built on that server. If an attacker can inject a malicious commit into your main branch and trigger an automated build, they've just turned your CI/CD pipeline into a malware delivery system. You aren't just dealing with a CPU spike anymore; you're distributing a backdoor to your entire client base. Patching this isn't as simple as clicking "update" on a managed service. Gitea is often deployed as a standalone binary or a Docker container managed by someone who left the company two years ago. Updating usually requires a restart of the service, which breaks the build pipeline and pisses off the developers. In many shops, the fear of interrupting a sprint outweighs the theoretical risk of an RCE. This rhymes with the Jenkins vulnerabilities we saw years ago. The pattern is always the same: target the developer tooling because it's usually the least guarded part of the infrastructure and holds the most privilege. The difference here is that Gitea has a smaller footprint, making it more attractive for stealthy persistence than a bloated Jenkins setup. CISA added six exploited flaws to the KEV list this week alone. That includes bugs in Linux kernels and SQL Server. It's a noisy week, which is exactly when these RCEs slip through the cracks. While everyone is staring at the big vendor headlines, the attackers are quietly indexing every self-hosted Git instance they can find. If you're running Gitea, stop reading this and check your version. If you're not on the latest patch, assume your server is already mining for someone else. The real question isn't whether you're patched, but what those attackers did with your SSH keys while you were sleeping.