Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit

A Chinese-speaking threat actor known as Red Heron rapidly weaponized a newly disclosed Gitea vulnerability (CVE-2026-60004) in a multinational campaign, leveraging an advanced Linux implant and rootkit to steal source code, harvest credentials, and establish deep, persistent access across high-value targets in government, energy, and critical infrastructure sectors.