Manifold Security disclosed on 2 September 2026 eight flaws across seven CLI coding agents: a repository delivered as an archive can trigger a local command on open, outside the sandbox and without approval, via Git’s core.fsmonitor setting. Disable core.fsmonitor by default and inspect .git/config before opening a received folder with an agent.

On August 29, 2026, Konstantin Ryabitsev published hard numbers on AI crawler traffic to the Linux kernel repositories: six million requests a day, a fifth of CPU capacity, and barely 2% legitimate traffic. For any public self-hosted service, it is proof that a proof-of-work challenge only moves the problem.

CVE-2026-60004, a critical code-injection flaw in Gitea, has been exploited in the wild since August 25, 2026: an attacker can run shell commands as the forge’s system user. Self-hosted instances with open registration are hit first; the fix comes down to an upgrade and a disable switch.

On August 2, 2026, Gitea shipped a critical fix for CVE-2026-59774, a path traversal that lets an unauthenticated attacker read any server file via Org-mode markup rendering on a public repository. Worse: by reading the INTERNAL_TOKEN from app.ini, the attacker can escalate to remote code execution. Every self-hosted Gitea administrator must patch and rotate secrets immediately.

Forgejo shipped version 16.0 on July 16, 2026, three and a half years after the community fork from Gitea. A single 100 MB Go binary replaces both GitHub and GitLab on the cheapest VPS money can buy, with GitHub Actions-compatible CI/CD and governance locked under a non-profit foundation.