30,000 Code Repos Exposed + Millions of AI Agents at Risk 🚨

Two major security stories broke today that every developer and business owner needs to know about — one hiding in plain sight for four years, the other threatening the AI tools your team may already be running.

🔓 Secret Code Exposed for 4 Years: The Gitea Container Bug

A security flaw in Gitea — a popular self-hosted code platform used by thousands of organizations — quietly allowed anyone on the internet to access "private" container images without logging in. This bug, tracked as CVE-2026-27771, went unnoticed for roughly four years and affected about 30,000 self-hosted Gitea and Forgejo instances worldwide, spanning industries like healthcare, aerospace, and SaaS companies.

Why does this matter to you? Container images are like shipping containers for software — they often hold your source code, configuration files, API keys, database passwords, and the wiring that keeps your systems running. Anyone who knew where to look could have pulled this sensitive data without a password. The fix is available: if your organization runs Gitea, upgrade immediately to v1.26.2.

Read more →

🤖 One Character. Millions of AI Agents Exposed.

A critical vulnerability was discovered in Starlette, the foundational framework that powers FastAPI and dozens of other popular tools used to build Python web services — including AI-focused platforms like vLLM, LiteLLM, and FastLLM. The scary part: an attacker can bypass security controls simply by adding a single extra character to a web request. No complex hacking required.

This means any web service or AI agent built on these frameworks could have its access controls bypassed, potentially allowing attackers to reach restricted endpoints, steal data, or take unauthorized actions. If your team builds or operates Python-based AI services, check whether your dependencies include Starlette and update them now. This one is trivially easy to exploit — don't wait.

Read more →

Stay ahead of threats with GOCO Security at gocosecurity.com.