Unpatched Gitea Servers: Over 8,300 Instances Exposed to Active RCE Attacks
Self-hosting a Git service on a VPS or dedicated server is a common choice for European developers, agencies, and small hosting providers that want control over their code pipeline. That choice now carries acute risk. According to cybersecurity watchdog Shadowserver, as reported by BleepingComputer, more than 8,300 Internet-exposed Gitea instances remain unpatched against a critical security flaw that is actively exploited in remote code execution (RCE) attacks. Gitea, a lightweight Go-based Git platform, is frequently deployed on small VPS nodes, cloud VMs, and bare-metal servers. An unpatched instance does not just risk the repository—it can hand an attacker arbitrary command execution on the host, threatening backups, databases, and adjacent customer workloads. This article breaks down who is affected, why exposure matters, what changed in the threat landscape, and what hosting operators should verify next. Related ServerSpan guide: CUPS RCE on Linux VPS: CVE-2026-34980 Chains to ...