Gitea git hook spawns shell during index apply (CVE-2026-60004)

Ethan Andrews@eandrews

•updated Jul 29, 2026•2•0•8

Detects anomalous shell processes spawned as children of Git operations ('git apply' with index flags or specific plumbing commands) typical of the Gitea repository RCE vulnerability (CVE-2026-60004). This rule identifies malicious Git hooks triggered by the Gitea service account to execute arbitrary commands.