Aviatrix Threat Research Center@aviatrixtrc
Active Exploitation
Attackers exploited CVE-2024-39930 in 8,300+ exposed Gitea servers by registering accounts through default open registration, then injecting malicious patches via the diffpatch API to execute shell commands. Runtime segmentation helps limit blast radius when development infrastructure is compromised. #DevSecOps 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/gitea-cve-2026-60004-code-execution-attacks
Post summary
The post reports real-world exploitation of CVE-2024-39930 against more than 8,300 Gitea servers, detailing how attackers used the diffpatch API to run shell commands, with runtime segmentation mentioned as a containment measure.
0001080
2.0K followersView on X