---
title: "Critical Gogs Zero-Day Exploited: 700+ Git Servers Compromised"
description: Critical zero-day flaw in Gogs exploited; attackers compromise 700+ servers using symlinks for remote code execution. No patch available yet.
canonical_url: https://codekeeper.co/ticker/critical-gogs-zero-day-exploit-compromises-servers
---

# Critical Gogs Zero-Day Exploited: 700+ Git Servers Compromised

Critical zero-day flaw in Gogs exploited; attackers compromise 700+ servers using symlinks for remote code execution. No patch available yet.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Dec 12, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-gogs-zero-day-exploit-compromises-servers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-gogs-zero-day-exploit-compromises-servers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-gogs-zero-day-exploit-compromises-servers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-gogs-zero-day-exploit-compromises-servers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-gogs-zero-day-exploit-compromises-servers%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-gogs-zero-day-exploit-compromises-servers%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A critical zero-day vulnerability (CVE-2025-8110) in Gogs, a popular self-hosted Git service, is being actively exploited by attackers who have already compromised over 700 instances. The flaw allows authenticated users to bypass security protections using symbolic links, leading to remote code execution. Discovered on July 10, 2025, the vulnerability exploits how Gogs handles file modifications through its API. Attackers create repositories with symlinks pointing to sensitive system files, then use the API to overwrite critical files and inject malicious commands. The attacks appear automated, targeting instances with open registration enabled. Infected servers show repositories with random 8-character names and deploy Supershell malware for persistent access. Despite responsible disclosure in July, no patch is available yet. **Source:** [Cybersecurity News](https://cybersecuritynews.com/gogs-0-day-vulnerability-exploited/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-gogs-zero-day-exploit-compromises-servers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-gogs-zero-day-exploit-compromises-servers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-gogs-zero-day-exploit-compromises-servers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-gogs-zero-day-exploit-compromises-servers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-gogs-zero-day-exploit-compromises-servers%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-gogs-zero-day-exploit-compromises-servers%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[![FBI arrests Canadian in Pennsylvania linked to ShinyHunters hack, part of efforts to dismantle the group after breaching FBI data.](https://codekeeper.co/hubfs/_sized/Generated%20Blog%20Post%20Images/fbi-arrests-canadian-in-shinyhunters-hack-800.png) Cyberattacks New Arrest in the Hunt for the FBI Jobs Site Hackers Oct 12, 2026](https://codekeeper.co/ticker/fbi-arrests-canadian-in-shinyhunters-hack)

[Cyberattacks Hackers Targeted French Supermarket Fridges, Spoiling Millions in Food Oct 14, 2026](https://codekeeper.co/ticker/cyberattack-on-french-supermarkets-refrigeration)

[Vulnerabilities Hackers Are Actively Exploiting a Critical WordPress Flaw — Update Now Sep 25, 2026](https://codekeeper.co/ticker/wordpress-vulnerability-cve-2026-87902)

[Ransomware Attack Shuts Down Evanston Township High School Aug 12, 2026](https://codekeeper.co/ticker/ransomware-attack-evanston-high-closure)