Storia in 6 fonti

Gogs Zero-Day Exposes Servers to Remote Code Execution

Open source Git service Gogs is affected by a critical-severity zero-day vulnerability that exposes servers to remote code execution.

Raccontata dainfoworld.comsecurityweek.combleepingcomputer.comthehackernews.comheise.detheregister.com

Confronto fonti

6 prospettive sulla stessa storia

AI · summaries

securityweek.comStai leggendo1 mesi fa

Gogs Zero-Day Exposes Servers to Remote Code Execution

Open source Git service Gogs is affected by a critical-severity zero-day vulnerability that exposes servers to remote code execution.

originale

bleepingcomputer.com1 mesi fa

New Gogs zero-day flaw lets hackers get remote code execution

An unpatched zero-day vulnerability in the Gogs self-hosted Git service can allow attackers to gain remote code execution (RCE) on Internet-facing instances.

Leggi questa versione → originale

thehackernews.com1 mesi fa

Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code

Gogs 9.4 CVSS flaw exploits git rebase injection on 1,141 exposed instances, enabling remote code execution.

Leggi questa versione → originale

infoworld.com1 mesi fa

Lack of response to critical vulnerability in Gogs is a reminder of the limits of open source projects

Two months after Rapid7 discovered the hole in the Git service, the project maintainer has yet to patch the bug.

Leggi questa versione → originale

theregister.com1 mesi fa

No fix yet for critical RCE bug in open-source Git service Gogs - exploit module is out

Gogs has an unpatched CVSS 9.4 RCE exploitable by any authenticated user on default installs, 10 weeks after Rapid7's responsible disclosure with no maintainer response. A public Metasploit module makes exploitation imminent — disable open registration and rebase merging immediately or migrate to Gitea.

Leggi questa versione → originale

heise.de1 mesi fa

Warten auf Sicherheitspatch: Self-hosted-Git-Service Gogs ist verwundbar

Angreifer können Gogs-Server in den Standardeinstellungen mit Schadcode attackieren. Bislang können Admins Systeme nur über einen Workaround schützen.

Leggi questa versione → originale

Timeline cronologica

1. giovedì 28 maggio 2026·infoworld.com
   

   Lack of response to critical vulnerability in Gogs is a reminder of the limits of open source projects

   Two months after Rapid7 discovered the hole in the Git service, the project maintainer has yet to patch the bug.

2. giovedì 28 maggio 2026·securityweek.com
   

   Gitea Vulnerability Exposed 30,000 Deployments to Attacks

   CVE-2026-27771, an access control vulnerability in Gitea, exposed over 30,000 deployments to unauthorized access.

3. giovedì 28 maggio 2026·bleepingcomputer.com
   

   New Gogs zero-day flaw lets hackers get remote code execution

   An unpatched zero-day vulnerability in the Gogs self-hosted Git service can allow attackers to gain remote code execution (RCE) on Internet-facing instances.

4. giovedì 28 maggio 2026·thehackernews.com
   

   Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code

   Gogs 9.4 CVSS flaw exploits git rebase injection on 1,141 exposed instances, enabling remote code execution.

5. venerdì 29 maggio 2026·heise.de
   

   Warten auf Sicherheitspatch: Self-hosted-Git-Service Gogs ist verwundbar

   Angreifer können Gogs-Server in den Standardeinstellungen mit Schadcode attackieren. Bislang können Admins Systeme nur über einen Workaround schützen.

6. venerdì 29 maggio 2026·securityweek.com
   

   Gogs Zero-Day Exposes Servers to Remote Code Execution

   Open source Git service Gogs is affected by a critical-severity zero-day vulnerability that exposes servers to remote code execution.

7. venerdì 29 maggio 2026·theregister.com
   

   No fix yet for critical RCE bug in open-source Git service Gogs - exploit module is out

   Researcher reported the vuln in March. Maintainers haven't responded to his messages since