CISA issued a warning this week about active exploitation of a critical flaw in Gitea, the self-hosted alternative to GitHub that many UK development teams and technical SMEs run themselves to keep source code and CI pipelines in-house rather than on a third-party platform. The vulnerability, CVE-2026-60004, scores 9.8 out of 10 on the CVSS severity scale and lets anyone with ordinary write access to a single repository execute arbitrary shell commands as the Gitea server’s own operating system user. One developer has already reported their instance was hit, with attackers dropping a cryptocurrency-mining payload.

This matters because self-hosting is a genuinely sensible choice for many small technical businesses, more control, no per-seat fees, code that never leaves your own infrastructure. But that control comes with a trade-off: you also own the patching. A managed platform like GitHub pushes security fixes to every customer automatically. A self-hosted Gitea instance only gets patched when someone on your team actually does it, and this flaw shows how costly that gap can be, ordinary contributor-level access is enough to compromise the whole server.

Why “just a crypto miner” isn’t the real risk

It’s tempting to read “attacker deploys a crypto miner” as a minor nuisance, higher electricity bills and a slower server, rather than a serious breach. That’s the wrong read. The exploit gives an attacker shell-level command execution on the machine hosting your source code. A crypto miner is often the first thing deployed because it’s low-effort and immediately profitable, not the limit of what’s possible. The same access could just as easily be used to read private repositories, plant backdoors in your own codebase before it ships to customers, or pivot to other systems on the same network. Treat any confirmed compromise as a full incident, not a performance problem.

What to do if you run Gitea

Check your version and patch immediately if you haven’t. The fix for CVE-2026-60004 is already available; the exposure window closes the moment you update.

Audit who currently has write access to your repositories, including any contractor or freelance developer accounts that may have been added months ago and never removed. The exploit specifically requires only ordinary write access, not admin rights, so a forgotten low-privilege account is a real path in.

Check your server for unexpected processes or unusually high CPU usage, the classic tell-tale of a crypto-mining payload, and treat any positive finding as a full compromise requiring credential rotation and a proper review, not just a process kill.

If your team doesn’t have the in-house capacity to keep on top of patching cycles for self-hosted infrastructure like this, it’s worth weighing that against the cost of a managed alternative, or bringing in a technical partner like CoolCoding to handle patching and monitoring properly rather than treating it as an occasional afterthought.

A wider lesson for anything you self-host

Gitea isn’t unique here, this is the recurring cost of running any self-hosted tool: project management boards, wikis, CI runners, internal dashboards, anything your business has spun up on its own server rather than paying a vendor to run for you. Each one is a piece of software with its own vulnerability disclosures, and each one only gets patched if someone is actually subscribed to those disclosures and has time set aside to act on them. It’s worth making a short list of everything your business self-hosts and asking, honestly, whether patching is someone’s actual job or something that happens “when there’s time”.

The takeaway

Self-hosting your development tools is a legitimate choice, but it moves the responsibility for patching squarely onto your business rather than a platform vendor. This week’s Gitea exploitation is a reminder that “we run it ourselves” only pays off if someone is actually watching for exactly this kind of alert and acting on it fast.