Hackers exploit critical Gitea flaw in code injection attacks

Attackers are actively exploiting the critical Gitea code injection vulnerability CVE-2026-60004. CISA added it to the KEV catalog and ordered U.S. federal civilian executive branch agencies to secure affected servers within three days.