The postmortem of the hack on my Forgejo instance is here! I had fun investigating and writing it, so I hope y’all enjoy reading about it :)
#Homelab #SelfHosted #Cybersecurity #Infosec
https://phunky.cafe/my-homelab-got-hacked/
Welp. My Forgejo instance got popped by CVE-2026-60004. Hooray for RCE 🙃
My two screw-ups were
1. I pinned it to v13 "for stability" forever ago, then forgot about it.
2. I accidentally left sign-ups enabled.
Grabbed the seemingly obfuscated payload script from the attacker's server. Looks like it hits a different IP and grabs one of three different binaries depending on the victim's CPU architecture. You best believe I'm grabbing those too
Will probably write a blog post on what I find, but I'll at least post updates here, too
#Homelab #SelfHosted #PatchYourShit #Forgejo
