A threat actor tracked as Red Heron, suspected of operating from China, has been linked to the swift exploitation of a recently disclosed remote code execution vulnerability in Gitea. The campaign targeted internet-facing Gitea instances and successfully compromised 13 organizations spanning six countries, according to The Hacker News.
The attacker scanned 1,386 Gitea instances as part of the operation, illustrating how quickly known flaws are weaponized once details become public. The scope of the scanning suggests an opportunistic but deliberate effort to find exposed, unpatched servers before defenders can respond.
Because this report relies on a single source, there are no differing perspectives to compare. Still, the incident underscores the urgency for anyone running Gitea to apply updates immediately, as active exploitation is already underway and the window for preventative action is narrow.