Forgejo patches critical RCE affecting versions through 16.0.3
New CapabilitiesThird critical 16.x security fix since July, after August cryptominer attacks
Today: Forgejo 16.0.4 fixes critical RCENew here? Follow stories to track developments over time. Create a free account to get updates when stories you care about change.
Overview
Updated 1 hour agoForgejo released version 16.0.4 on September 10 to close a critical remote code execution vulnerability affecting every version through 16.0.3. The news reached Hacker News the same day.
It is the third 16.x patch release to carry security fixes since mid-July. The stretch includes CVE-2026-60004, a patch-application bug rated 9.8, which attackers exploited in August to plant cryptominers and steal credentials.
Why it matters
Forgejo instances running anything older than 16.0.4 are remotely exploitable, and operators on out-of-support releases have no patch path.
Questions about this story
Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.
No questions yet — be the first to ask.
Key Indicators
Voices
Curated perspectives — historical figures and your fellow readers.
Play
Exploring all sides of a story is often best achieved with Play.
Higher or Lower
A number from this story, against one from elsewhere in the news — guess which is bigger, then keep the chain going. 5 rounds, 3 strikes; a miss costs a strike and resets your streak.
Keyboard: ↓/L lower · ↑/H higher
0 points — sign up to put that on the leaderboard.
Connections
Sixteen names from the news. Find the four hidden groups of four. Four mistakes max.
Sign up to keep a daily streak — a new puzzle lands every day.
Exit debate?
Your progress in this debate will be lost.
- 1 Two AI personas square off on this story.
- 2 You predict who'll win each round — correct picks earn XP.
- 3 One crossfire question is yours to fire. Pick it carefully.
Couldn't generate a topic
Select Your Champions
Choose one persona for each side of the debate
DEBATE TOPIC
Choose personas with different perspectives for a more dynamic debate.
Select debater for this side:
No debate personas available right now.
Select debater for this side:
No debate personas available right now.
Who's Got This Round?
Make your prediction before the referee scores
The referee scores both sides on
Round Results
Set the Crossfire
Pick the question both personas must answer in the final round
Debate Oracle! You called every round!
Sharp Instincts! You know your debaters!
The Coin Flip Strategist! Perfectly balanced!
The Contrarian! Bold predictions!
Inverse Genius! Try betting the opposite next time!
XP Breakdown
Prediction History
People Involved
Organizations Involved
A self-hosted Git platform forked from Gitea in late 2022, used by Codeberg and others.
The self-hosted Git platform Forgejo forked from; Forgejo inherits its codebase.
The Cybersecurity and Infrastructure Security Agency tracks vulnerabilities exploited in the wild.
Maintains the Metasploit penetration-testing framework, which ships public exploits.
Timeline
July 2026 September 2026
-
Forgejo 16.0.4 fixes critical RCE
Today SecurityForgejo releases 16.0.4 to patch a critical RCE affecting versions through 16.0.3; Hacker News reports the same day.
-
Postmortem published
StatementOperator publishes a detailed postmortem of the Forgejo compromise.
-
Service restored
ResponseOperator scopes the incident and restores Forgejo service the same day.
-
Compromise detected
IncidentCompromise detected: 94 attacker accounts, exfiltrated credentials, cryptominer running.
-
CISA adds CVE to KEV catalog
GovernmentCISA adds CVE-2026-60004 to its Known Exploited Vulnerabilities catalog.
-
Forgejo releases v15.0.7 and v16.0.3
SecurityForgejo releases v15.0.7 and v16.0.3 with multiple security fixes.
-
Homelab instance compromised
IncidentHomelab Forgejo v13 instance compromised; cryptominer installed.
-
Automated scanning detected
IncidentAutomated scanning for the diffpatch RCE detected in the wild.
-
First attacker activity recorded
IncidentFirst attacker activity exploiting CVE-2026-60004 recorded on a Forgejo instance.
-
Forgejo v16 patches stored XSS
SecurityForgejo v16 security patches fix stored XSS and access control bugs.
Historical Context
3 moments from history that rhyme with this story — and how they unfolded.
Equifax and Apache Struts (2017)
Apache patched a critical RCE in its Struts framework (CVE-2017-5638) in March 2017. Equifax had not applied it; attackers exploited the flaw in May, stealing data on 147 million people. The breach was disclosed in September.
Equifax reached a settlement exceeding $1 billion and replaced its leadership.
The case became the standard example of a known, patchable RCE left unpatched in production.
The Forgejo postmortem told the same story: the fix was out for a week while the instance ran a version six months past end of life.
GitLab CVE-2021-22205 (2021)
A critical RCE in GitLab CE/EE, a self-hosted Git platform, was exploited in the wild. Attackers installed cryptominers on unpatched instances before GitLab issued urgent fixes.
GitLab pushed emergency patches and CISA added the CVE to its catalog.
Self-hosted Git forges became a recognized target class for cryptominer deployment.
The same target class, the same payload, and the same failure mode: unpatched self-hosted instances.
Log4Shell (2021)
A critical RCE in Apache Log4j, a logging library embedded in hundreds of thousands of applications, forced every downstream project to scramble. Many inherited the flaw without knowing they ran it.
Organizations spent months inventorying and patching affected software.
It demonstrated how a single upstream bug ripples through every fork and dependency.
Forgejo inherited CVE-2026-60004 from Gitea, its upstream fork source. Downstream projects carry upstream bugs until they ship their own patches.
