700+ self-hosted Gits battered in 0-day attacks with no fix imminent

Attackers are actively exploiting a zero-day bug in Gogs, a popular self-hosted Git service, and the open source project doesn't yet have a fix. More than 700 instances have been compromised in the ongoing attacks, according to Wiz researchers, who described the zero-day discovery as "accidental" and say that it happened in July while they were investigating malware on an infected machine. "During our analysis of the exploitation attempts, we identified that the threat actor was leveraging a previously unknown flaw to compromise instances. We responsibly disclosed this vulnerability to the maintainers," security sleuths Gili Tikochinski and Yaara Shriki said in a Wednesday blog. The team reported the security hole to Gogs' maintainers, who are "currently working on a fix," Tikochinski and Shriki wrote. But, they added, "active exploitation continues in the wild." The bug is tracked as CVE-2025-8110, and anyone running a Gogs server (version 0.13.3 or earlier) that is internet exposed and has open-registration enabled - this is the default setting - is vulnerable. CVE-2025-8110 is essentially a bypass of a previously patched bug (CVE-2024-55947) that allows authenticated users to overwrite files outside the repository, leading to remote code execution (RCE). The earlier RCE was discovered by Manasseh Zhou. "Unfortunately, the fix implemented for the previous CVE did not account for symbolic links," the Wiz kids wrote. Gogs is written in Go, and it allows users to host Git repo...