--- title: Gitea auth bypass exploited in the wild, Java 25... description: A critical authentication bypass in Gitea's Docker image (CVE-2026-20896) is being actively exploited across roughly 6,200 exposed instances — patch to 1.26.3... canonical: https://daily.dev/posts/gitea-auth-bypass-exploited-in-the-wild-java-25-delivers-22-throughput-gain-g5hjkofqt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Gitea auth bypass exploited in the wild, Java 25 delivers 22% throughput gain | daily.dev og:description: A critical authentication bypass in Gitea's Docker image (CVE-2026-20896) is being actively exploited across roughly 6,200 exposed instances — patch to 1.26.3... og:url: https://daily.dev/posts/gitea-auth-bypass-exploited-in-the-wild-java-25-delivers-22-throughput-gain-g5hjkofqt og:image: https://api.daily.dev/og/posts/g5hjkofQT.png og:image:alt: Gitea auth bypass exploited in the wild, Java 25 delivers 22% throughput gain og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Gitea auth bypass exploited in the wild, Java 25 delivers 22% throughput gain **[Backend Digest](https://daily.dev/sources/backend_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary A critical authentication bypass in Gitea's Docker image (CVE-2026-20896) is being actively exploited across roughly 6,200 exposed instances — patch to 1.26.3 or 1.26.4 now. Trendyol's real-world benchmarks show Java 25 delivering 22.7% more throughput and 20.1% lower latency versus Java 21, with 63–120MB less RAM. GPT-5.6 launched as a three-tier efficiency-focused family with pricing from $1/$6 to $5/$30 per million tokens. Progress Software is urging ShareFile customers to immediately shut down on-premises Storage Zone Controllers over a credible but undisclosed security threat. ## Content **TLDR:** A critical authentication bypass in Gitea's Docker image (CVE-2026-20896) is being actively exploited across roughly 6,200 exposed instances — patch to 1.26.3 or 1.26.4 now. Trendyol's real-world benchmarks show Java 25 delivering 22.7% more throughput and 20.1% lower latency versus Java 21, with 63–120MB less RAM. GPT-5.6 launched as a three-tier efficiency-focused family with pricing from $1/$6 to $5/$30 per million tokens. Progress Software is urging ShareFile customers to immediately shut down on-premises Storage Zone Controllers over a credible but undisclosed security threat. --- ## Gitea CVE-2026-20896 actively exploited: default Docker config trusts any IP for auth bypass The flaw is embarrassingly simple: the default REVERSE_PROXY_TRUSTED_PROXIES=* setting causes Gitea to accept the X-WEBAUTH-USER header from any IP, letting anyone impersonate any user including admins with no credentials. Exploitation was detected 13 days after the advisory dropped, with roughly 6,200 instances publicly exposed. Patch to 1.26.3 or 1.26.4 immediately; if you can't, restrict REVERSE_PROXY_TRUSTED_PROXIES to specific trusted IPs and audit your access logs. [Read more](https://daily.dev/posts/S26AoyGcU) ## Java 21 to 25: 22.7% throughput increase and 20.1% latency reduction in production at Trendyol Trendyol's International Payment team ran real-world benchmarks comparing Java 21 and Java 25, finding 22.7% more RPS, 20.1% lower average latency, 63–120MB less RAM, and 50% less network data overhead. A few migration gotchas worth knowing: -XX:+UseCompactObjectHeaders is not on by default, Gradle must be at v9.1+ for compatibility, and you need to rebuild rather than just swap the runtime image to get the full benefit from optimized class layout. Post-production rollout showed roughly 10% memory reduction. [Read more](https://daily.dev/posts/803tN2ccW) ## GPT-5.6 launches as three-tier efficiency model family OpenAI released GPT-5.6 on July 9 as Sol, Terra, and Luna — positioned as cheaper and faster than GPT-5.5 with comparable or better results. Sol leads on coding (Artificial Analysis Coding Agent Index: 80) and cybersecurity (ExploitBench: 73.5%). Real-world signals from Cursor and Lovable show 25–48% fewer steps and tool calls in production workflows. Pricing runs from $1/$6 per million input/output tokens for Luna up to $5/$30 for Sol. The release also adds Programmatic Tool Calling and a multi-agent beta in the Responses API. [Read more](https://daily.dev/feed-by-ids?id=iQdZxDFG6&id=77ra0mLVS) ## Progress Software urges immediate ShareFile server shutdown over undisclosed credible threat Progress has proactively disabled cloud access to affected ShareFile on-premises Storage Zone Controller accounts but says manual Windows server shutdown is also required. No unauthorized access has been confirmed yet and the nature of the threat hasn't been disclosed — the comparison to the 2023 MOVEit zero-day exploited by the Clop ransomware gang is hard to ignore. If you're running ShareFile Storage Zone Controllers on-premises, treat this as urgent. [Read more](https://daily.dev/posts/NIlSINzqc) --- ## Also notable - **AWS EKS zonal shift: static stability principle for gray-zone failures:** AWS published lessons from operating Kubernetes across millions of EKS clusters, explaining how gray-zone failures cascade into regional outages when automated systems keep reacting — the fix is a free, single-CLI-command zonal shift feature that cordons impaired nodes and reroutes traffic without evicting pods, with weekly practice runs available. [Read more](https://daily.dev/posts/396oc7g9a) - **Manticore Search 28.4.4 fixes auth bypass in MySQL multi-statement execution:** The release covers versions 27.2.0 through 28.4.4 and includes 17 bug fixes, among them an auth/authorization bypass in MySQL multi-statement execution — users with external UDF/ranker/token-filter plugins must rebuild binaries due to a plugin ABI version bump in 28.0.0. [Read more](https://daily.dev/posts/NYWHo7TPy) - **UK designates Microsoft, Google, Amazon, Oracle as critical to financial system, effective July 13:** The first designations under the Financial Services and Markets Act 2023 bring all four cloud giants under direct Bank of England, PRA, and FCA oversight for resilience testing and incident reporting — triggered by over 65% of UK organisations depending on the same four providers. [Read more](https://daily.dev/posts/COPdMkVTM) - **Datadog FoundationDB-to-PostgreSQL migration: 45-minute operations cut to ~1 second, 90% DB cost reduction:** Datadog's Stream Router migration used Claude and Cursor in a test-driven workflow — not autonomously, but guided method-by-method with failing tests — achieving latency reductions from hundreds of milliseconds to a few, up to 40x data storage reduction, and 90% lower database costs. [Read more](https://daily.dev/posts/fkPp9yv7O) - **Cloudflare temporary accounts let AI agents deploy Workers without authentication:** Using `wrangler deploy --temporary`, agents get a live Workers deployment for up to 60 minutes with no account creation or OAuth flow required, removing a key blocker for non-interactive agent workflows — though hard billing caps are still missing. [Read more](https://daily.dev/posts/16hFFQCSd) ## Similar posts on daily.dev - [Over 8,300 Gitea servers vulnerable to code execution attacks](https://daily.dev/posts/over-8-300-gitea-servers-vulnerable-to-code-execution-attacks-rbh2jcepp) · BleepingComputer · 1 upvotes · 0 comments - [Java 21 to 25: 22.7% increase in throughput \(RPS\) and a 20.1% reduction in average latency.](https://daily.dev/posts/java-21-to-25-22-7-increase-in-throughput-rps-and-a-20-1-reduction-in-average-latency--803tn2ccw) · Trendyol Tech · 21 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#gpt](https://daily.dev/tags/gpt) [View this post on daily.dev](https://daily.dev/posts/gitea-auth-bypass-exploited-in-the-wild-java-25-delivers-22-throughput-gain-g5hjkofqt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/gitea-auth-bypass-exploited-in-the-wild-java-25-delivers-22-throughput-gain-g5hjkofqt","headline":"Gitea auth bypass exploited in the wild, Java 25 delivers 22% throughput gain","text":"A critical authentication bypass in Gitea's Docker image (CVE-2026-20896) is being actively exploited across roughly 6,200 exposed instances — patch to 1.26.3 or 1.26.4 now. Trendyol's real-world benchmarks show Java 25 delivering 22.7% more throughput and 20.1% lower latency versus Java 21, with 63–120MB less RAM. GPT-5.6 launched as a three-tier efficiency-focused family with pricing from $1/$6 to $5/$30 per million tokens. Progress Software is urging ShareFile customers to immediately shut down on-premises Storage Zone Controllers over a credible but undisclosed security threat.","url":"https://daily.dev/posts/gitea-auth-bypass-exploited-in-the-wild-java-25-delivers-22-throughput-gain-g5hjkofqt","datePublished":"2026-07-11T04:19:15.785Z","dateModified":"2026-07-11T04:19:34.191Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"Gitea auth bypass exploited in the wild, Java 25 delivers 22% throughput gain"}]} ```