Weekly Roundup: Trusted Software Turned Against Defenders, Plus a Critical Gogs Flaw
From signed drivers hijacked to disable antivirus tools, to a code-execution bug in the Gogs source-code platform, this week's threats show how attackers keep lowering the bar.
Key points
- A new remote code execution flaw in Gogs 10.0, the self-hosted software for storing source code, lets attackers run commands on servers through a weak input check.
- The workflow automation tool n8n was found to have a bug that turns a saved automation into a way to run attacker code on the host machine.
- The US State Department is offering a $10 million reward for information on state-linked hackers, part of its Rewards for Justice programme.
- Researchers used the GLM-5.3 AI model to help find and refine working exploits, cutting the time from bug discovery to weaponised code.
- Attackers keep abusing signed drivers and legitimate apps to slip past security software, a technique known as living-off-the-land.
This week's security news has a common thread: trusted software doing exactly what it was told, and attackers taking full advantage. Signed drivers, meaning system files carrying a valid digital signature from the maker, are being flipped around to switch off antivirus tools. Legitimate apps are giving malware a place to hide. And a sloppy header check in one popular tool opens the door to full server takeover.
None of this is exotic. That is the point.
What is the Gogs bug and who does it affect?
Gogs is a self-hosted platform for storing and managing source code, similar to GitHub but run on a company's own servers. A newly disclosed remote code execution flaw in Gogs 10.0 lets an attacker send a crafted request that the server then runs as a command. In plain terms: if you can reach the login page, you may be able to run programs on the machine behind it.
Any team running Gogs on the public internet should treat this as urgent. Pull the instance behind a VPN, patch to the fixed release as soon as the maintainers publish it, and check server logs for odd process activity.
How does the n8n workflow bug work?
n8n is an automation tool, the kind of software that connects your email, spreadsheets and cloud services so tasks run without a human clicking through them. Researchers found that a malicious workflow, once imported or shared, can escape its sandbox and execute code on the host system. A workflow file is meant to be data. Here it becomes a program.
The risk lands hardest on teams that accept workflow templates from outside sources or run n8n in shared environments. Treat imported workflows the way you would treat an unknown email attachment.
Why does the $10 million reward matter?
The US State Department has put up a $10 million bounty through its Rewards for Justice programme for tips leading to the identification of hackers working on behalf of foreign governments. Cash bounties are not new, but the size and frequency of these payouts signal that Washington sees private tip-offs as a faster route to attribution than intelligence work alone.
For defenders, the practical takeaway is smaller: if your logs show state-linked activity, there is a formal channel and a real financial incentive to report it.
What is the AI angle?
Separately, researchers demonstrated using GLM-5.3, a large language model, to help write and refine working exploit code against known bugs. The model did not invent new attacks. It sped up the grunt work of turning a vulnerability writeup into something that runs. That gap, between a bug being disclosed and a working exploit being available, is shrinking. Patch windows need to shrink with it.
The week at a glance
| Item | What it is | Who should care |
|---|---|---|
| Gogs 10.0 RCE | Code execution via weak header check | Anyone self-hosting Gogs |
| n8n workflow RCE | Malicious workflow escapes sandbox | Teams importing shared automations |
| $10M reward | State Department bounty for state-linked hacker intel | Incident responders with attribution data |
| GLM-5.3 exploit research | AI model used to speed up exploit writing | Every patch manager |
| Signed driver abuse | Legit signed drivers used to kill antivirus | Windows endpoint teams |
As The Hacker News noted in its own roundup, the pattern this week is less about clever new attacks and more about attackers wringing more value out of tools that were never meant to fight back.
