September 15, 2026
- Red Heron industrialized a public Gitea PoC within days. Acronis TRU assesses the cluster as China-linked with moderate confidence and says it began abusing CVE-2026-60004 on July 29. It scanned 1,386 instances across seven countries, kept a separate dataset of 477 Taiwan systems, and confirmed 13 organizational compromises in six countries. Activity reached root on a three-node Proxmox cluster and deployed JITTERLY plus the SIXZUT
LD_PRELOADrootkit. · Exploitation & Vulnerability Research
in Scope Questions Recast Anthropic’s “Rogue Agent” Incidents