InfoSecBulletin Cybersecurity for mankind
CISA has instructed government agencies to protect their systems from Gogs vulnerability exploited in zero-day attacks. Designated as CVE-2025-8110, this remote code execution (RCE) vulnerability originates from a path traversal issue within the PutContents API.
It empowers authenticated attackers to circumvent the safety measures established for a previously resolved RCE flaw (CVE-2024-55947), enabling them to overwrite files beyond the repository through symbolic links.
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Wiz Research uncovered the critical vulnerability while examining a malware infection on a customer’s Internet-facing Gogs server in July. They officially reported this issue to the Gogs maintainers on July 17. It wasn’t until three months later, on October 30, that the maintainers acknowledged the report. Recently, they released patches for CVE-2025-8110, implementing symlink-aware path validation across all file-write entry points.
Wiz researchers discovered over 1,400 exposed Gogs servers, with 1,250 still vulnerable, and over 700 showing signs of being compromised.
CISA confirmed Wiz’s report about the security flaw and added it to its list of real-world vulnerabilities, instructing Federal Civilian Executive Branch agencies to fix it by February 2, 2026.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” CISA warned. “Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”
