https://reddit.com/r/netsec/comments/1wh7wol/red_heron_exploits_gitea_nday_flaw_in/: Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit
Published Sep 15, 2026
·Updated
Affected Software
1 affected component
gitea
Frequently Asked Questions
1
Which deployments were most exposed in this campaign?
Internet-facing Gitea instances were scanned and targeted. The actor surveyed 1,386 instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems.
2
Which types of organizations were selected as targets?
Target classifications included defense, elections, energy, aerospace, telecommunications, government, and research. Confirmed compromises affected organizations in Canada, Argentina, Taiwan, the United States, and Sri Lanka.
3
What could the actor do after compromising a Gitea instance?
Observed activity progressed from source-code theft to persistent access, credential collection, and lateral movement. In one case, the actor obtained root-level access to a three-node Proxmox cluster.