Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit

Reported 15 Sep 2026 by otx · Severity: medium

A Chinese-speaking threat actor tracked as Red Heron rapidly weaponized CVE-2026-60004, a critical Gitea remote code execution vulnerability, within days of public disclosure in July 2026. The actor scanned 1,386 Gitea instances across seven countries, successfully compromising o