Zero-Day Drama: Over 700 Gogs Git Servers Hacked Amid Missing Fix!
Attackers are exploiting a Gogs zero-day bug, and more than 700 instances are compromised. While the flaw in the self-hosted Git service remains unfixed, Wiz researchers urge users to disable open-registration. Meanwhile, Gogs’ maintainers are scrambling for a fix, hoping it arrives before hackers get too comfortable.
Hot Take:
Gogs, the self-hosted Git service, is experiencing a mid-life crisis and is being exploited through a zero-day vulnerability. While it’s busy soul-searching, hackers are having a field day. Time to grab some popcorn as the plot thickens, and Gogs’ maintainers scramble to patch things up. Who knew Git repositories could be this dramatic?
Key Points:
- A zero-day bug, CVE-2025-8110, is being actively exploited in the Gogs Git service.
- More than 700 instances have been compromised, with attacks leveraging symlink vulnerabilities.
- The flaw enables remote code execution by overwriting critical files outside the repository.
- Wiz researchers accidentally discovered the bug while investigating malware.
- No fix is available yet, but disabling open-registration and using a VPN can mitigate risks.
Already a member? Log in here