Red Heron Leverages Gitea Zero‑Day to Exfiltrate Code and Install Linux Rootkit

Security researchers have confirmed that a threat group identified as Red Heron exploited a critical remote‑code‑execution flaw in the open‑source Git service Gitea (CVE‑2026‑60004), using it to pilfer source‑code repositories and embed a covert Linux toolset on compromised servers.

Gitea, a lightweight, self‑hosted Git management platform, is popular among small development teams and enterprises that prefer on‑premises control over their code. Because it runs as a web application, any vulnerability that permits unauthenticated code execution can give an attacker full control of the host environment, making the CVE‑2026‑60004 defect especially dangerous.

According to the initial report by the GBHackers community, Red Heron leveraged the flaw to execute arbitrary commands on vulnerable instances without needing valid credentials. The group then accessed and copied multiple repositories, effectively stealing intellectual property and the underlying build assets stored on the compromised machines.

Beyond theft, the actors established long‑term footholds by deploying a custom Linux rootkit composed of two components: the JITTERLY implant and the SIXZUT LD_PRELOAD library. JITTERLY provides a stealthy backdoor that can receive commands over encrypted channels, while SIXZUT hijacks the dynamic linking process to remain hidden from typical system monitoring tools.

The compromise carries significant supply‑chain implications. By obtaining source code, Red Heron could inject malicious code into future releases, potentially spreading compromised binaries to downstream users. Organizations that rely on Gitea for internal development pipelines may find their entire software ecosystem exposed if the breach goes undetected.

Following the disclosure, the Gitea development team issued an emergency patch that addresses the underlying RCE vector. Security advisories have been circulated urging administrators to apply the update immediately, audit server logs for suspicious activity, and rotate any credentials that may have been accessed.

Experts recommend a layered response: verify that all Gitea instances are running the patched version, enforce network segmentation to limit exposure, and deploy endpoint detection tools capable of spotting anomalous LD_PRELOAD behavior. Regular code‑integrity checks and reproducible builds can also help detect unauthorized modifications.

The incident underscores a broader trend of threat actors targeting self‑hosted development tools, which often receive less frequent security scrutiny than commercial SaaS alternatives. As more teams adopt on‑premises solutions for compliance or cost reasons, analysts expect similar exploit attempts to surface, reinforcing the need for continuous vulnerability management and rapid patch deployment.