This week, it’s the self-hosted users who are in the spotlight: an authentication bypass in the official Gitea Docker image, the first KVM escape that works on both Intel and AMD, and six vulnerabilities in U-Boot’s signature verification. Plus, three supply-chain attacks, all targeting developers.

Actively exploited: The attack requires no credentials, only an accessible instance. (Quelle: Security Affairs on active exploitation)

Deep Dive: Self-Hosting Security Under Pressure

Gitea: A Single HTTP Header Is Enough to Gain Admin Privileges

The official Gitea Docker image contains a critical authentication bypass (CVE-2026-20896, CVSS 9.8). The cause is not a bug in the Gitea code itself, but rather the default setting for REVERSE_PROXY_TRUSTED_PROXIES in the image: it trusts authentication headers from any source IP address. Users who have enabled reverse proxy authentication can be impersonated by unauthenticated attackers using a forged X-WEBAUTH-USER header as any user—including administrators.

Affected images include versions up to and including 1.26.2. According to Security Affairs, approximately 6,200 Gitea instances are exposed on the web; according to Sysdig, exploitation began nearly two weeks before the vulnerability was publicly disclosed. Once inside, an attacker can read private repositories, exfiltrate secrets, and inject code into CI/CD pipelines.

For anyone running Gitea or Forgejo themselves, this is the most urgent issue of the week: Update the image and explicitly configure the trusted proxy instead of relying on the default settings.

Januscape: 16-Year-Old KVM Bug Allows Escape from the VM

A use-after-free vulnerability in KVM’s Shadow MMU emulation allows escape from a guest VM to the host (CVE-2026-53359, “Januscape”). Two things are noteworthy: The flaw was present in the kernel for 16 years, and it is the first KVM guest-to-host escape that works on both Intel and AMD x86 systems. The exploit requires root privileges in the guest; from there, code can be executed on the host or other VMs on the same host can be disrupted.

Google paid the maximum bounty of $250,000 through its kvmCTF program—the tier reserved for a full VM escape. The patch was merged into the mainline kernel on June 19. For Proxmox and KVM administrators with multiple tenants on a single host, this is the vulnerability to address this week.

Zimbra: Stored XSS in the Classic Web Client

With Daffodil v10.1.19, fixed a stored XSS vulnerability in the Classic Web Client (CVE-2025-66376). JavaScript in a specially crafted HTML email is executed in the context of the session when viewed. According to BleepingComputer, the Russia-linked actor TA488 (also known as Void Blizzard or Laundry Bear) exploited the vulnerability for about five months, established persistent access, and skimmed email accounts. If you self-host Zimbra, apply the patch and then check for persistence.

U-Boot: Six Vulnerabilities in the Signature Verification Process

In the U-Boot bootloader, six vulnerabilities in the FIT signature verification process (BRLY-2026-037 through BRLY-2026-042)—two allow code execution, and four allow a denial of service. The timing is critical: All six are exploited while U-Boot is reading an image that has not yet been verified—that is, before the signature has been checked. In doing so, they bypass precisely the mechanism intended to support Verified Boot and the Root of Trust.

Most of the vulnerable code has existed since U-Boot 2013.07 and thus affects over 50 releases as well as manufacturers who have incorporated it into their own firmware—ranging from server BMCs to networking equipment to industrial and IoT devices.

Deep Dive: Supply Chain Attacks on Developers

Ghostcommit: Prompt Injection in PNG

On July 11, researchers at the University of Missouri-Kansas City presented Ghostcommit: Malicious instructions are hidden in PNG files that are pushed into the repository via a pull request. The blind spot is structural—neither human nor automated reviewers open the image files when reviewing a PR, but the AI coding agent does read them later and executes whatever is contained within. The result: secrets from the repository end up in the attacker’s hands.

HalluSquatting: Agents Install Packages That Never Existed

On July 8, a team from Tel Aviv University, the Technion, and Intuit described an attack technique that turns the models’ own hallucinations into a weapon. The crux of the matter: Models do not generate package, repository, and skill names randomly, but rather in a reproducible manner—with up to 85 percent identical names in repository queries and 100 percent in skill installations. Anyone who registers these names in advance can be reliably installed by third-party agents.

A discovery by Aikido Security in January 2026 shows that this is not just a lab problem: The fabricated npm package react-codeshift had already spread to 237 projects via AI-generated instructions—and continued to be installed daily by agents.

Injective SDK: 18 npm Packages with Wallet Stealers

On July 8, a backdoor was introduced into the Injective SDK on npm. Disguised as analytics code, it intercepted wallet recovery phrases and private keys as soon as a wallet was created or loaded. The source was @injectivelabs/sdk-ts version 1.20.21; the automated release system distributed the code to 18 other packages within minutes.

No damage was caused: The packages were online for less than an hour and were downloaded 310 times; no funds were lost. What stands out is the lead time—suspicious commits date back to June 8, a full month before the release.

FakeGit: 7,600 Compromised GitHub Repositories

A large-scale campaign used 7,600 compromised GitHub repositories, to spread SmartLoader and StealC malware. Before cloning an unknown repository, it’s worth checking the stars, forks, and commit history—the fakes can usually be identified this way.

Digest: Other Important News

Security

ShareFile: Progress Orders Servers Shut Down: On July 10, Progress Software instructed its customers to shut down the Windows servers of their ShareFile Storage Zone Controllers—due to a “credible external threat.” A patch was not available at that time.
Global Wave of Attacks on CMS Installations: On July 9, Australia’s ACSC warned of a large-scale campaign targeting WordPress, Craft CMS, MaxSite, MetInfo, and Joomla JCE. Successful attacks leave behind webshells. All exploited vulnerabilities are publicly known and have been patched—so only those who haven’t updated are at risk. According to the ACSC’s assessment, the speed of the scanning and exploitation suggests the use of an AI-powered attack tool.
AssuranceAmerica: 6.9 million records: Data belonging to 6,998,886 individuals, including driver’s license numbers, was copied from the U.S. auto insurer. The breach occurred on March 16 using an employee’s login credentials. Payment card data and Social Security numbers were not compromised.

AI & Development

Microsoft’s bug bounty program now covers third-party code: Microsoft will now also pay for critical vulnerabilities in its online services even if the affected code was not developed by Microsoft. Last year, the program paid out over $17 million.

Infrastructure & Cloud

OpenMandriva: Sabotage from Within: On July 8, a contributor with administrator privileges deleted parts of the GitHub repositories and published an empty package in the Cooker branch that marked all GNOME and COSMIC packages as obsolete. This was triggered by a dispute in the project’s Matrix chat. The permissions stemmed from an earlier repository migration—a cautionary tale about access rights that persist even after a project ends.
Forg365: Phishing Platform Targeting Microsoft 365: The Phishing-as-a-Service platform, distributed via Telegram, combines device code attacks with adversary-in-the-middle routing and AI-generated lures. A browser extension keeps the connection open without requiring the attacker to log in again.
Helix: Vishing via CEO Impersonation: The extortion group initiates its attacks with phone calls in which operators impersonate the victim’s superiors—sometimes using a spoofed phone number—and lure employees into a device code phishing scheme. SharePoint data is then extracted. Overlaps in methodology and registrar suggest connections to ShinyHunters.

Compiled on July 11, 2026. Sources: The Hacker News, BleepingComputer, Security Affairs, Proofpoint, ACSC.

IT News Week 27/2026: Gitea Authentication Bypass, KVM VM Escape, Supply Chain Attacks