PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-8110] Gogs 0-Day Exploited in the Wild

wiz.io | vulnerability | CVE-2025-8110 | #rce | #zero-day | #vulnerability | #symlink | #gogs | #cve-2025-8110 | #git-service
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz found Gogs zero-day CVE-2025-8110 exploited in the wild: a symlink bypass of the CVE-2024-55947 fix lets authenticated users write outside the repo for RCE; 700+ instances hit, fixed in v0.13.4.
CVE
CVE-2025-8110
Published
Collected

Related coverage

Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
vulnerability · volexity.com
[CVE-2026-85046] Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP
# Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP October 16, 2026 Volexity Volcano Team Last month, Volexity published two blog posts in its _Mind the (Patch)...
vulnerability · volexity.com
[CVE-2026-104935] A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
# A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days October 13, 2026 Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team **_Volexity...
vulnerability · volexity.com
Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits
On September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different Chinese advanced persistent threat (APT) actors. Shortly after that blog post was published, Volexity discovered additional campaigns—this time from a third Chinese threat actor, tracked by Volexity under the alias UTA0565—that used the same chained exploits on September 3-4, 2026, while the vulnerabilities were still unpatched. Notably, this threat actor’s campaigns differed from previously documented attacks by using multiple fake websites to deceive victims.
Back