Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

Gogs 0-Day Vulnerability Exploited in the Wild to Hack 700+ Instances

A critical zero-day vulnerability, designated as CVE-2025-8110, has been identified in Gogs, a self-hosted Git service. This vulnerability enables authenticated users to execute a symlink bypass, leading to Remote Code Execution (RCE). Currently, no…

LBy Lucas NorwoodDec 12, 20251 min read

A critical zero-day vulnerability, designated as CVE-2025-8110, has been identified in Gogs, a self-hosted Git service. This vulnerability enables authenticated users to execute a symlink bypass, leading to Remote Code Execution (RCE). Currently, no patch is available, and over 50% of public-facing Gogs instances are estimated to be compromised.

The vulnerability was discovered on Tue, Jul 10, 2025, during an investigation of a malware infection. Analysts identified that threat actors were exploiting a regression in the Gogs API to bypass protections for CVE-2024-55947. The issue stems from Gogs' handling of file modifications via its API, particularly the failure to validate the destination of symlinks. Attackers can commit symlinks that point to sensitive files outside the repository and use the PutContents API to write data, resulting in RCE.

The exploitation requires an account with repository creation privileges. Due to many Gogs instances having open registration, the attack surface is extensive. Approximately 1,400 public-facing Gogs instances have shown signs of compromise, with over 700 confirmed affected. The attacks are characterized by the creation of repositories with random names and the delivery of a payload using Supershell, a Command and Control (C2) framework.

Vulnerability Summary and Indicators of Compromise (IoCs)

Feature Details

Zero-Day CVE CVE-2025-8110 (Symlink Bypass)

A critical zero-day vulnerability, designated as CVE-2025-8110, has been identified in Gogs, a self-hosted Git service.
Lucas Norwood · Thehackingpost

Related CVE CVE-2024-55947 (Original RCE)

Affected Software Gogs (Self-Hosted Git Service)

Affected Versions v0.13.3 and prior

Status Unpatched (Active Exploitation)

Advertisement

C2 IP Address 119.45.176[.]196, 106.53.108[.]81, 119.91.42[.]53

Administrators of Gogs instances are advised to assume compromise if their instance is exposed to the internet with open registration. Immediate steps include disabling "Open Registration" and restricting service access through VPN or IP allow-lists. Additionally, security teams should scan for unexpected repositories or unusual usage of the PutContents API.

Based on reporting by Cyber Security News.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026