OTX Threat: Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit

A Chinese-speaking threat actor tracked as Red Heron rapidly weaponized CVE-2026-60004, a critical Gitea remote code execution vulnerability, within days of public disclosure in July 2026. The actor scanned 1,386 Gitea instances across seven countries, successfully compromising organizations in Canada, Argentina, Taiwan, the United States, and Sri Lanka. Activities included source code theft, cred CVEs: CVE-2026-60004 Sectors: Defense, Government, Energy