CYBERSECURITYTRACKER
Permanent story citation

Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 7245

As cited

Copy frozen at (site build).

vulnerabilities

Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

Red Heron, a suspected Chinese threat actor, exploited a recently disclosed remote code execution (RCE) vulnerability in Gitea to compromise 13 organizations across six countries. The group scanned over 1,386 Gitea instances globally and maintained a separate dataset of 477 Taiwan-based systems as part of a coordinated campaign.

Why it matters: Organizations running internet-facing Gitea instances are under active attack; practitioners should immediately identify and patch vulnerable Gitea deployments and review access logs for signs of exploitation.

Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

vulnerabilities

Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

Red Heron, a suspected Chinese threat actor, exploited a recently disclosed remote code execution (RCE) vulnerability in Gitea to compromise 13 organizations across six countries. The group scanned over 1,386 Gitea instances globally and maintained a separate dataset of 477 Taiwan-based systems as part of a coordinated campaign.

Why it matters: Organizations running internet-facing Gitea instances are under active attack; practitioners should immediately identify and patch vulnerable Gitea deployments and review access logs for signs of exploitation.

VendorsGitHubSynologyWordPress
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary