
- CISA added Gogs CVE-2025-8110 to its Known Exploited Vulnerabilities catalog
- Critical symlink bypass enables unauthenticated Remote Code Execution via PutContents API
- Over 700 Gogs servers compromised; agencies must patch by February 2, 2026
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a new bug to its Known Exploited Vulnerabilities (KEV) catalog, signaling not only that it is being actively exploited in the wild, but also ordering Federal Civilian Executive Branch (FCEB) agencies to patch it, or stop using the vulnerable software entirely.