Phillip :usa_distress: on Nostr: Welp. My Forgejo instance got popped by CVE-2026-60004. Hooray for RCE 🙃 My two ...
Welp. My Forgejo instance got popped by CVE-2026-60004. Hooray for RCE 🙃
My two screw-ups were
1. I pinned it to v13 "for stability" forever ago, then forgot about it.
2. I accidentally left sign-ups enabled.
Grabbed the seemingly obfuscated payload script from the attacker's server. Looks like it hits a different IP and grabs one of three different binaries depending on the victim's CPU architecture. You best believe I'm grabbing those too
Will probably write a blog post on what I find, but I'll at least post updates here, too
#Homelab #SelfHosted #PatchYourShit #Forgejo
Published at
2026-08-08 19:01:48 UTCEvent JSON
{
"id": "4eeb023b8fb96a658a220710726755a46e34100ecf5b5ea29662b51b63bcbbaa",
"pubkey": "03c23a8a5f00dd4f46261e96a736d4b6d455c4ef46bdd013ff5159da9ebc729d",
"created_at": 1786215708,
"kind": 1,
"tags": [
[
"t",
"forgejo"
],
[
"t",
"patchyourshit"
],
[
"t",
"homelab"
],
[
"t",
"selfhosted"
],
[
"proxy",
"https://social.lol/@phillip/117061432689860232",
"web"
],
[
"proxy",
"https://social.lol/users/phillip/statuses/117061432689860232",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://social.lol/users/phillip/statuses/117061432689860232",
"pink.momostr"
],
[
"-"
]
],
"content": "Welp. My Forgejo instance got popped by CVE-2026-60004. Hooray for RCE 🙃 \n\nMy two screw-ups were \n1. I pinned it to v13 \"for stability\" forever ago, then forgot about it. \n2. I accidentally left sign-ups enabled.\n\nGrabbed the seemingly obfuscated payload script from the attacker's server. Looks like it hits a different IP and grabs one of three different binaries depending on the victim's CPU architecture. You best believe I'm grabbing those too\n\nWill probably write a blog post on what I find, but I'll at least post updates here, too\n\n#Homelab #SelfHosted #PatchYourShit #Forgejo",
"sig": "ab084a819c746780c428393e89adb7a1e03472e806c2f0513a19feedea3a909fd21469cc9228c427f185b9701cf477d5f6a2383d5ffa2e1e27ea55ac78c76257"
}
