Attackers are actively exploiting a critical-severity vulnerability in the Gitea self-hosted Git service, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Like cloud-hosted GitHub or GitLab SaaS (Software as a Service) platforms, Gitea provides a full suite of DevOps tools, but it is designed to be used as a self-hosted software development platform. Tracked as CVE-2026-60004 and reported by Salesforce security researcher Shai Rod, this code injection security flaw allows an authenticated user with repository write access to repositories hosted on vulnerable servers to execute arbitrary shell commands with the privileges of the Gitea service account by submitting malicious patches via the diffpatch API endpoint. However, default-configured Gitea instances have self-registration enabled, allowing unauthenticated attackers to register an account, create a new repository, and trigger the vulnerability without prior credentials.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Gitea flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in flaw, tracked as CVE-2026-60004 (CVSS score of 9,8), to its Known Exploited Vulnerabilities (KEV) catalog. Gitea is an open-source platform for hosting and managing Git repositories. Think of it as a self-hosted alternative to GitHub or GitLab. CVE-2026-60004 is a critical remote code execution flaw that allows an attacker with write access to a repository to execute arbitrary shell commands as the Gitea service user. The flaw affects Gitea versions from 1.17 and was fixed in 1.27.1. The vulnerable diffpatch API can be abused to plant and execute a malicious Git hook. Because Gitea enables open registration by default, an unauthenticated attacker can create an account, create a repository, and exploit the flaw without existing credentials. A reported attack used the vulnerability to deploy a cryptocurrency-miner-like payload after an exposed Gitea instance allowed open registration and anonymous access to its web interface. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by August 28, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
WhatsApp says 1 billion users now use passkeys, while stronger two-step verification and caller context add new layers of account protection. WhatsApp has reached a significant security milestone: more than one billion people now use passkeys to protect access to their accounts. At the same time, Meta is adding stronger two-step verification and more information about calls from people who aren’t in a user’s contacts. Passkeys let users sign back into WhatsApp with a fingerprint, Face ID or their device’s screen-lock code instead of relying on passwords, PINs or one-time codes. WhatsApp now also allows people who use both Android and iOS devices to add more than one passkey to the same account, which removes one of the practical limitations of the earlier implementation. “More than 1 billion people now use a passkey: A passkey lets you log back into WhatsApp with your fingerprint, face ID, or screen lock code. It’s the fastest and most secure way to verify it’s really you, with no codes or PINs.” reads the announcement published by WhatsApp. “More than a billion people have already set one up, and you can now add more than one passkey to your account if you use both Android and iOS devices. To get started, go to Settings > Account > Passkeys.” For people who move between platforms, the ability to register multiple passkeys should make account recovery less dependent on a single device. It is important to highlight that WhatsApp is moving account protection away from secrets that users have to remember or type. Passkeys rely on credentials stored on the device and protected by its existing biometric or screen-lock mechanism, which also makes phishing them much harder than a traditional password or verification code. WhatsApp is also changing its two-step verification system. Until now, the additional protection relied on a six-digit PIN. The company has now upgraded it to a full password that can be longer, use letters and numbers, and include special characters. “Two-step verification is an extra protection layer that helps prevent someone from taking over your account, even if they get hold of your one-time passcode.” continues the announcement. “Until now it was a six-digit PIN, we’ve now upgraded it to a full password: longer, alphanumeric, and even with special ch@racters to make it harder to guess. If you’ve been using “123456,” this is your sign to upgrade.” That’s a small interface change with a meaningful security consequence. A short numeric PIN has a limited number of possible combinations and encourages users to choose predictable values, while a longer password gives account owners a much stronger second factor. WhatsApp makes the point in unusually direct terms, even calling out the classic 123456 choice. If that’s still protecting an account, the app has just provided a fairly unambiguous hint. The change also addresses a specific account-takeover scenario. If an attacker manages to obtain a user’s one-time registration code, the additional password can still prevent the takeover from succeeding. The third change targets a different problem: social engineering. On Android, WhatsApp will now provide additional context when someone outside the user’s contacts calls. The information can include whether the number comes from another country and whether the caller shares any groups with the recipient. That gives users a little more information before they decide whether to answer. “When you get a call from someone not saved in your contacts, a little context can help you decide whether to pick up. On Android, you’ll now see more information about a non-contact caller, like whether the number is from a different country and if you have any groups in common.” concludes the announcement. “Scammers rely on urgency – now you can take a beat with some more info before answering.” It’s a simple addition, but it addresses a common weakness in fraud attempts: pressure. An unexpected call creates a sense of urgency, and attackers often use that moment to persuade someone to disclose information, click a link or continue the conversation on their terms. Giving the recipient more context doesn’t stop a scammer from calling. It gives the user a reason to pause before answering. Taken together, the three changes target different parts of the same account-security problem. Passkeys make authentication harder to steal, stronger two-step verification provides another barrier when a one-time code is compromised, and caller context gives users more information before a potentially suspicious interaction begins. The billion-user passkey figure is also worth watching beyond WhatsApp. It suggests that phishing-resistant authentication is no longer an experimental security feature limited to security-conscious users. At this scale, the challenge shifts from convincing people that passkeys are safer to making sure they understand when and how to use them. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, WhatsApp)
The Los Angeles County Museum of Art (LACMA) has announced that a breach last year exposed customer and employee information. The museum says that on July 11, 2025, it detected suspicious activity on its systems that had started four days earlier. A month later, the investigation confirmed that the network was compromised. At the time, the type of exposed data could not be determined, and the first results of the investigation became available in late February 2026. More than a year after the discovery of the data breach incident, the museum identified that the following information may have been accessed by the attacker: LACMA says it has notified law enforcement authorities about the incident and sent personalized data breach notifications to impacted individuals. Recipients are recommended to monitor their bank accounts for suspicious activity, consider placing a security freeze or fraud alert on their credit file, and report identity theft attempts to their financial institutions and law enforcement.
Norway ’s shared government infrastructure suffered a third DDoS attack, disrupting digital services but showing no signs of data compromise. Norway ‘s shared digital government infrastructure has been hit by another distributed denial-of-service (DDoS) attack that disrupted services used by citizens, businesses and public agencies. The incident began at 03:38 CEST on Monday, August 24, and targeted infrastructure operated by the Norwegian Digitalisation Agency, Digdir, together with its service provider Vivicta. The timing matters because this isn’t an isolated event. Digdir says it’s the third DDoS attack against its services in a short period, following incidents in June and on August 3. “The Norwegian Directorate for Digitalisation (Digdir) has been subjected to a denial of service attack (DDoS attack) that has been ongoing since 03:38 on the night of Monday, August 24.” reads the statement published by Digdir Agency. “This is the third time in a short time that this type of attack has been directed at Digdir’s solutions. Digdir is working closely with our subcontractor Vivicta. NSM and the Norwegian Data Protection Authority have also been notified of the case.” That status update refers to the test environment, but the underlying attack also affected production services. Digdir reported that several shared services became completely unavailable for short periods, while others remained accessible but suffered connection failures, slow responses and longer-than-usual login times. Digdir operates several pieces of Norway’s shared public-sector infrastructure. Among them are ID-porten, MinID, Maskinporten, eFormidling, eInnsyn, the Contact and Reservation Register, Ansattporten and other services used by government agencies and external applications. That makes an attack on Digdir more significant than an ordinary website outage. When a shared authentication service goes down, the disruption can propagate to services that aren’t themselves under attack. That’s exactly what happened. Altinn, Norway’s central platform for communication between citizens, businesses and government, was also affected, while other public services relying on ID-porten experienced login problems. Earlier attacks this summer produced similar effects, including disruption to access to Helsenorge, NAV and Skatteetaten. The technical distinction is important: the attackers didn’t need to break into every downstream service. They could create disruption simply by overwhelming a shared dependency. And that’s often the uncomfortable reality of modern public infrastructure. The weakest point isn’t necessarily the service citizens see on their screens. It can be the common authentication, messaging or data-exchange layer underneath it. Digdir has stressed that the incident is about availability, not evidence of a successful intrusion. The agency also says it has found no indication that personal data was exposed. Digdir has notified Norway’s National Security Authority, NSM, and the Data Protection Authority, Datatilsynet, as part of its response. “There are no indications that the attack has led to a security breach or that personal data has been compromised, says Director Frode Danielsen at Digdir.” continues the statement. That distinction deserves attention because cyberattack doesn’t automatically mean “data theft”. In this case, the confirmed impact is service disruption, while there is currently no evidence that attackers compromised Digdir’s systems or accessed personal information. The operational consequences are still serious. Public-sector users may see failed connections, slow responses or authentication problems even though the underlying applications themselves haven’t been compromised. The June incident already demonstrated how much disruption a DDoS attack against Digdir’s infrastructure can cause. That attack targeted ID-porten through Vivicta’s network infrastructure and temporarily affected services including ID-porten, MinID, Maskinporten, eInnsyn and eFormidling. Another attack followed on August 3. Digdir restored normal operations the following day, but the agency said the incident had again affected several shared services and that it would review the event together with Vivicta and other partners. Now there’s a third incident. That repetition is more interesting from a defensive perspective than the raw duration of any single outage. Digdir and Vivicta are clearly able to mitigate the attacks and restore services. The harder question is whether repeated attacks against the same shared infrastructure can keep generating enough operational friction to become a recurring problem for the wider public sector. This is where DDoS stops being just a bandwidth problem. A sufficiently persistent campaign can force defenders to keep changing traffic controls, filtering rules and protection measures, while legitimate users continue to depend on the same infrastructure. Digdir’s own status updates show that dynamic clearly. On August 24, the agency first reported improvement, then said several solutions were completely down, followed by further stabilization efforts. There is currently no official attribution for the attacks. Norwegian media have raised the possibility of Russian involvement, but that remains speculation rather than an established finding. That distinction matters. A DDoS campaign can be politically motivated, financially motivated, conducted for disruption or simply intended to demonstrate capability. Without technical evidence and an official attribution process, assigning responsibility to a particular state or group would be premature. What is established is the target and the effect. The attacks repeatedly hit infrastructure that sits underneath a large number of Norwegian digital public services. That’s enough to make the incidents strategically relevant without adding an attribution story that the evidence doesn’t yet support. The Norwegian case is also a useful reminder that cybersecurity isn’t limited to confidentiality and integrity. Availability is a security property too, particularly when the affected systems provide national digital services. A compromised database is an obvious security incident. An authentication service that repeatedly becomes unavailable can create a different kind of problem: citizens can’t access services, businesses can’t complete procedures and government agencies may struggle to perform routine operations. Digdir says its services have largely stabilized, although some disruptions remain. As of the latest incident updates, ID-porten still had limitations, eSignering remained unavailable because of those ID-porten restrictions, and some users were still reporting connection problems or increased response times with Maskinporten. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
A large distributed denial-of-service (DDoS) attack has disrupted Norway’s shared government digital infrastructure since Monday, affecting services used by the public sector. The attack started at 03.38 CEST on Monday and has targeted the infrastructure supporting services operated by the Norwegian Digitalization Agency, Digitaliseringsdirektoratet (Digdir), and its operations provider, Vivicta. Digdir operates Norway’s shared digital government infrastructure, including public-service logins, electronic IDs and signatures, secure digital mail, government forms, public-record access, and data exchange between agencies. In an announcement published earlier today, the organization states that several services were completely unavailable for short periods. The agency says many affected systems have now been stabilized, although some services, like ID-porten and eSignering, remain partially inaccessible.
Healthcare and services provider Nutex is investigating a data breach incident where an unauthorized third party exfiltrated information from company servers. The organization has disclosed the cyberattack in a filing with the U.S. Securities and Exchange Commission (SEC), noting that the stolen data includes details that may be private or confidential. “Based on preliminary findings from the Company’s ongoing investigation, the Company believes that certain information maintained on the Company’s servers was accessed and exfiltrated by an unauthorized third party, including some information that may be private and/or confidential,” Nutex says. Nutex Health is a for-profit healthcare company that operates 28 facilities across 12 states, including the Bayou City ER & Hospital in Texas and Green Bay ER & Hospital in Wisconsin.
Microsoft updated its Windows PowerToys toolset with a new utility dubbed "Window Hopper" that lets users switch between an app's windows more quickly. The Window Hopper added in this release works like the standard ALT + TAB Windows feature, but it only works for the currently focused app, helping users switch back and forth between its windows. "Once the utility is enabled, press the configurable Alt + backtick shortcut to cycle through that app's windows without stepping through everything else on your desktop," Microsoft explains. "It is especially useful when you're juggling multiple browser windows, terminals, File Explorer windows, or editor instances." Those who want to customize the default activation keyboard shortcut can also do so in PowerToys settings to switch to the next and previous app window.
WhatsApp has started rolling out several new account security features, including support for multiple passkeys and stronger two-step verification. While the instant messaging service already allowed users to add passkeys for secure logins via fingerprint, Face ID, or screen lock code, it now lets them create separate ones for each platform. "More than a billion people have already set one up, and you can now add more than one passkey to your account if you use both Android and iOS devices. To get started, go to Settings > Account > Passkeys," it said. WhatsApp has also updated its two-step verification security feature to allow alphanumeric passwords instead of six-digit PINs. "Until now it was a six-digit PIN, we've now upgraded it to a full password: longer, alphanumeric, and even with special ch@racters to make it harder to guess. If you've been using '123456,' this is your sign to upgrade," WhatsApp added.
Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock (LockA locked padlock) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. Staying Secure at Eventsno-cost Cyber ServicesCybersecurity Awareness MonthKnown Exploited Vulnerabilities CatalogReport A Cyber Issue WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA) published an advisory about lessons learned from red team assessments performed at the request of two critical infrastructure organizations to help organizations strengthen detection, response and protections in information technology (IT), cloud, and operational technology (OT) environments.
Confirm this action.
Leaving now will discard your changes.