Red Heron: Gitea CVE-2026-60004 diffpatch API RCE exploitation attempt

Arnold Chan@slaz

•updated Sep 15, 2026•0•0•1

Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.