Critical Gogs zero-day under attack, 700 servers hacked

Hackers exploited an unpatched Gogs zero-day, tracked as CVE-2025-8110, to achieve remote code execution and compromise around 700 Internet-facing servers. Wiz researchers identified the flaw as a path-traversal issue in the PutContents API, enabling attackers to abuse symbolic links to overwrite files outside the repository and bypass protections from a previous RCE bug (CVE-2024-55947).

The advisory notes that over 1,400 Gogs servers were publicly exposed, with more than 700 confirmed as compromised, indicating that more than half of the exposed instances showed signs of compromise. All the affected deployments displayed a pattern of randomly generated 8-character owner/repo names created within a short window on 10 July, pointing to a single actor or group using the same automation tools, with malware built on Supershell communicating to a C2 server at 119.45.176[.]196.

The vulnerability was reported on 17 July and acknowledged by maintainers on 30 October, with a second attack wave beginning on 1 November, according to Wiz. According to Wiz, administrators are urged to disable open registration, restrict access via VPN or allow lists, and review PutContents activity and suspicious repositories to assess compromise.