Attackers Waste No Time With Critical Gitea Bug

It took just 13 days. That’s how long threat actors needed to start probing a critical vulnerability in Gitea Docker images after the fix went public. Security researchers at Sysdig spotted the first exploitation attempts in the wild, and the timeline is a stark reminder of how fast attackers move.

The flaw, tracked as CVE-2026-20896, carries a CVSS score of 9.8 — critical by any measure. It lives in the way Gitea handles the X-WEBAUTH-USER HTTP header. The DevOps platform trusted that header from any source IP address. That’s a big problem.

An unauthenticated client on the internet could simply send a crafted request with that header and get elevated access. No credentials needed. No authentication bypass tricks. Just a header.

How the Gitea Docker Flaw Works

The vulnerability is rooted in Gitea’s authentication logic for Docker registries. When a request arrives, the platform checks the X-WEBAUTH-USER header to determine who’s making the request. The assumption was that only trusted proxies would set that header.

But that assumption was wrong. Sysdig’s researchers found that Gitea didn’t validate the source of the header. Any client — even a random bot scanning the internet — could set it to any username and gain that user’s privileges.

Think about what that means. An attacker could impersonate an admin. They could pull private Docker images. They could push malicious images to a repository. The impact depends on what the compromised account can do, but in a DevOps environment, that’s often everything.

Why This Gitea Vulnerability Is Dangerous

Several factors make CVE-2026-20896 particularly nasty:

• No authentication required: The attacker doesn’t need valid credentials. They just send the header.
• Remote exploitation: The flaw is exploitable over the network. No local access needed.
• High privilege escalation: The attacker can assume any user’s identity, including administrators.
• Docker registry exposure: Gitea is often used to host private container images. A breach there leaks sensitive code and configurations.

Sysdig’s report notes that the exploitation attempts began just under two weeks after the patch was released. That’s a short window for organizations to update their instances.

Who’s Affected and What to Do

Any organization running Gitea in a Docker container — especially if the instance is exposed to the internet — is at risk. The vulnerability affects versions before the patch that addressed the header trust issue.

If you’re running Gitea, the fix is straightforward: update to the latest version immediately. The Gitea team released a patch that stops trusting the X-WEBAUTH-USER header from untrusted sources. Sysdig also recommends reviewing your Gitea configuration to ensure that if you use reverse proxies, they are properly configured to strip or validate that header.

For teams that can’t update immediately, a workaround exists: block the X-WEBAUTH-USER header at your web application firewall or reverse proxy. But that’s a stopgap, not a solution. The patch is the real fix.

Lessons for DevOps Security

This incident highlights a broader issue in modern infrastructure. DevOps tools like Gitea, GitLab, and Jenkins often run with elevated privileges and handle sensitive data. They’re juicy targets for attackers.

The trust assumption in HTTP headers is a classic mistake. It’s the same kind of flaw that plagued authentication systems for years — trusting something the client can control. Gitea’s developers fixed it, but the 13-day gap between patch and exploitation shows that attackers are watching the same security mailing lists and GitHub repos as defenders.

Organizations should treat security patches for critical vulnerabilities as emergencies. A CVSS 9.8 flaw in a tool that manages container images and CI/CD pipelines isn’t something to schedule for next month’s maintenance window. It’s a fire.

Sysdig’s research is a useful reminder that container security isn’t just about scanning images for known vulnerabilities. It’s also about hardening the platforms that manage those images. A flaw like this one bypasses all your image scanning because it gives the attacker direct access to the registry.

The bottom line? Patch Gitea now. Check your logs for suspicious requests containing X-WEBAUTH-USER headers from unexpected sources. And take a hard look at how your DevOps tools handle authentication. The attackers certainly are.

Iran’s MOIS-Linked Group Deploys Cavern in Targeted Campaign

An Iranian hacking group tied to the country’s Ministry of Intelligence and Security (MOIS) has been using a previously unknown modular command-and-control (C2) framework called Cavern — also spelled Cav3rn — to zero in on Israeli organizations. The campaign, uncovered by Check Point Research, has primarily hit IT providers and government entities.

This isn’t just another phishing spree. The attackers built a custom C2 infrastructure from scratch. Cavern is modular, meaning it can swap out components on the fly. That flexibility makes it harder to detect and even harder to shut down.

Who’s Behind Cavern? A MOIS-Linked Threat Cluster

Check Point attributes the activity to a threat cluster that operates under the umbrella of Iran’s MOIS. The group has a track record of targeting Israeli infrastructure, but Cavern marks a technical leap. It’s not a repurposed tool — it’s purpose-built for this campaign.

The victims are telling. IT providers serve as a gateway: compromise one, and you can pivot to dozens of downstream clients. Government targets offer intelligence value. The attackers seem to want both access and information.

How Cavern Works: A Modular C2 Framework

Cavern’s architecture is what makes it stand out. It uses encrypted channels to communicate with implants on compromised machines. Each module handles a specific task — data exfiltration, keylogging, lateral movement — and can be updated or replaced without redeploying the entire framework.

• Encrypted C2 traffic: Blends in with normal HTTPS, making network monitoring harder.
• Modular plugins: Attackers can add or remove capabilities on demand.
• Persistence mechanisms: Uses scheduled tasks and registry modifications to survive reboots.

This modularity is a double-edged sword for defenders. It means the framework can evolve quickly. But it also means that if you spot one module, you might not see the full picture — and the next variant could look completely different.

Targeting Israeli IT Providers and Government Agencies

The campaign’s focus on IT providers is strategic. By compromising a managed service provider (MSP), the attackers can piggyback on legitimate remote administration tools to reach the provider’s clients. That’s a supply chain attack, and it’s been a rising trend globally.

Government targets are more direct: espionage. The attackers appear interested in policy documents, internal communications, and possibly diplomatic cables. Check Point’s report notes that the group used spear-phishing emails with malicious attachments to gain initial access.

Once inside, they deployed Cavern’s implants to establish a persistent foothold. From there, they could move laterally, escalate privileges, and siphon data without triggering alarms.

Technical Deep Dive: Cavern’s Implant and C2 Communication

The Cavern implant is a lightweight executable that phones home to the C2 server using HTTP or HTTPS. The C2 server itself is a PHP-based panel that manages infected machines and issues commands.

Key technical details from Check Point’s analysis:

• Implant size: Roughly 50 KB, compiled with MinGW to avoid common antivirus signatures.
• C2 panel: Hosted on compromised servers in multiple countries, including the Netherlands and the United States.
• Command set: Includes file upload/download, shell execution, process listing, and screen capture.

The attackers also used a custom DNS tunneling technique to bypass network filters. That’s a newer trick: encode data in DNS queries, which many organizations don’t monitor closely.

What This Means for Israeli Cybersecurity Teams

For defenders in Israel — and anyone watching Iranian cyber activity — Cavern is a wake-up call. It shows that MOIS-linked groups are investing in bespoke tooling, not just repurposing existing malware.

Check Point recommends organizations review their network logs for unusual DNS traffic, especially to domains registered in Iran or with suspicious patterns. They also advise tightening access controls on IT provider connections — because a breach at the provider could cascade to your own network.

The Cavern C2 framework is still active, and Check Point expects more variants. This isn’t a one-off operation. It’s a sustained campaign with a dedicated toolkit.

Israeli IT providers and government agencies should treat any unusual system behavior — even seemingly minor anomalies — as a potential sign of Cavern activity. The framework’s modular nature means the attackers can adapt faster than traditional signature-based defenses can keep up.

From teen hacker to Iron Dome researcher, Ocean raises $28M to fight AI phishing with agentic email security

Shay Shwartz knows the dark side of email phishing all too well. As a teenager, he earned money as a hacker, but after getting caught at age 16, he turned his talents toward defense. Now, his startup Ocean has emerged from stealth with $28 million in funding to combat AI phishing using an agentic email security platform.

The round was led by Lightspeed Venture Partners, with participation from Picture Capital and Cerca Partners. High-profile angel investors also joined, including Wiz co-founder and CEO Assaf Rappaport, as well as Yevgeny Dibrov and Nadir Izrael, the co-founders of Armis, which recently sold to ServiceNow for $7.75 billion.

How Ocean tackles AI phishing with agentic security

Ocean claims its AI can thoroughly analyze the context of every incoming email to detect fraud and impersonation attempts. Unlike traditional vendors like Proofpoint and Mimecast, which focus on standard phishing detection, Ocean uses a small language model tailored to quickly analyze emails, understand the sender’s intent, and evaluate it against the user’s specific organizational context.

“This is like having a guard in every door,” Shwartz said. “This is how we make the inbox a safe place with high hygiene.” The platform is already reviewing billions of emails each month for customers, including Kayak, Kingston Technology, and Headspace.

Why AI phishing requires a new defensive approach

In the past, only highly sophisticated hackers could pull off spear-phishing due to the sheer amount of time, research, and manual labor needed to launch targeted attacks. However, AI has changed the game entirely. “AI just made the entire process automatic, so the scale is much, much bigger now,” Shwartz told TechCrunch. “I can instruct LLM to go and understand exactly who you are, harvest large amount of public information, and create those phishing attacks very targeted against you.”

This means that AI-powered attacks are now accessible to a wider range of malicious actors, increasing the urgency for advanced defense mechanisms. Ocean’s approach is designed to counter this new threat landscape by providing real-time, context-aware protection.

From hacker to Iron Dome researcher: Shwartz’s journey

Shwartz’s path to founding Ocean is unconventional. After his teenage hacking stint, he spent about a decade in top-tier cybersecurity roles, leading major projects for Israel’s elite defense and intelligence units, including work connected to the Iron Dome project. He later joined Axis, the startup later acquired by HPE. All along, he had been itching to launch his own startup, and two years ago, he finally took the plunge.

This background gives Ocean a unique edge in understanding both offensive and defensive cybersecurity strategies. The company’s agentic email security platform is built to fight AI phishing attacks that traditional systems might miss.

How Ocean’s technology works

Ocean built a small language model specifically designed for email analysis. It examines the full context of each message, including the sender’s history, the content, and the recipient’s role within the organization. This allows it to detect subtle impersonation attempts and fraudulent requests that might otherwise slip through.

As a result, Ocean provides a layer of protection that adapts to each user’s unique communication patterns. Learn more about email security best practices to complement your defense strategy.

The future of email security in an AI-driven world

With the rise of generative AI, the threat landscape is evolving rapidly. Ocean’s funding round signals strong investor confidence in agentic security solutions. The startup plans to use the capital to expand its team and enhance its AI capabilities.

For businesses, the message is clear: traditional phishing defenses are no longer enough. Explore our guide to AI threat detection to understand how to stay ahead of emerging risks. Ocean’s approach represents a significant step forward in the fight against AI phishing.

In conclusion, Ocean’s emergence from stealth with $28 million marks a pivotal moment in cybersecurity. By combining the founder’s unique background with cutting-edge AI, the platform offers a promising solution to one of the most pressing digital threats today. Contact us to learn how Ocean can protect your organization.