Your source code server is a production server. Attackers figured that out before most security teams did.
CVE-2026-60004 — critical code injection in Gitea, CVSS 9.8. CISA added it to the KEV catalog on August 25 after confirmed exploitation in the wild. Over 8,300 internet-exposed instances are still unpatched.
WHAT ACTUALLY HAPPENED
The flaw abuses Gitea's diffpatch endpoint. An attacker with ordinary repository write access can plant an executable Git hook and run arbitrary shell commands as the Gitea service account.
Write access to any repo. That is the whole bar.
A documented incident shows how low that bar really is: a self-hosted Gitea server running an outdated version, with open user registration, no email confirmation and no CAPTCHA. An automated scanner registered its own account, created its own repository, triggered the exploit chain, and dropped crypto-mining software.
The fix shipped in Gitea 1.27.1 on July 27, with the advisory the next day. Federal agencies had until August 28 to remediate.
WHY DEV INFRASTRUCTURE IS THE SOFTEST CROWN JEWEL
Self-hosted Git is usually stood up by engineering, not IT. It ends up outside the patch cycle, outside asset inventory, outside EDR — and often with open registration left on from day one because it was "internal".
But it holds your source code, your CI credentials, your deployment keys and your infrastructure-as-code.
A miner is the lucky outcome. The same access lets an attacker modify a repository, poison a build, or read every secret ever committed. From there, compromise moves down the pipeline into production with your own automation carrying it.
Nobody ranks their Git server as tier-one infrastructure. Every attacker does.
WHAT TO DO NOW
UPGRADE TO GITEA 1.27.1 OR LATER — exploitation is confirmed and thousands of instances remain exposed.
DISABLE OPEN REGISTRATION — if strangers can create accounts on your code platform, "authenticated write access" means nothing.
TAKE IT OFF THE PUBLIC INTERNET — put self-hosted Git behind VPN or zero trust access rather than a public IP.
AUDIT REPOS AND HOOKS FOR TAMPERING — review recent Git hooks, unexpected commits, new accounts and outbound connections from the server before assuming you patched in time.
The pipeline that builds your software is part of your software.
Who patches your source control platform — security, or the team that installed it?