Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
Acronis TRU attributes rapid exploitation of Gitea vulnerability to Chinese threat actor in multi-national campaign
Key Takeaways
- Chinese threat actor Red Heron actively exploiting Gitea instances globally.
- 1,386 Gitea instances scanned across seven countries; 477 Taiwan-based systems identified separately.
- 13 organizations across six countries confirmed compromised.
- Potential access to source code, CI/CD pipelines, and sensitive data.
Related Security News
Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials
The maintainers of the official MCP Python SDK disclosed a security vulnerability that could allow a malicious server to trick applications into divulging OAuth credentials. The issue affects the handling of client secrets, authorization codes, and PKCE proof keys when communicating with token endpoints.
Former US Air Force Members Sentenced to Prison for Business Email Compromise Scams
Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. The sentencing, reported by BleepingComputer in September 2026, concluded a federal case targeting individuals who abused their military backgrounds to conduct financially motivated email fraud. The attacks spanned multiple years prior to sentencing, though specific victim counts and total financial losses were not detailed in the reporting. The case underscores the legal consequences of using military credentials and training for cyber-enabled fraud.
