Loading story…
Attackers exploited two authentication bypass flaws in the open-source Qinglong task scheduler to achieve remote code execution on publicly exposed panels and deploy a hidden cryptominer named .fullgc. The bugs, tracked as CVE-2026-3965 and CVE-2026-4047, affected Qinglong 2.20.1 and earlier and were tied to mismatches between Qinglong’s authorization middleware and Express.js routing behavior. One flaw let unauthenticated attackers reset administrator credentials through rewritten /open/* paths, while the other enabled direct code execution by abusing case-insensitive handling on /api/ endpoints.
Researchers said exploitation began around February 7, 2026, before public disclosure later that month, with compromised systems showing sustained CPU usage of 85% to 100% as the malware posed as a benign Java Full GC process. Attackers altered config.sh to fetch payloads from file.551911.xyz, delivering miner binaries for Linux x86_64, ARM64, and macOS. Qinglong maintainers acknowledged that an initial mitigation was incomplete, and the effective fix was later delivered in PR #2941; defenders were urged to update containers, inspect systems for hidden .fullgc files, and restrict Qinglong panels behind VPNs or other access controls.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-01, Qinglong maintainers confirmed the authentication bypass and remote code execution issues affecting version 2.20.1 and earlier. They advised users to update, refresh Docker containers, inspect systems for hidden '.fullgc' files, and restrict panel access.
On 2026-02-27, researchers publicly disclosed technical details for the two Qinglong vulnerabilities, later tracked as CVE-2026-3965 and CVE-2026-4047. The flaws were tied to mismatches between Qinglong's authorization middleware assumptions and Express.js routing behavior.
Around 2026-02-07, attackers started exploiting two authentication bypass vulnerabilities in publicly exposed Qinglong task scheduler panels to gain remote code execution and install the hidden '.fullgc' cryptominer. Administrators observed abnormal activity and severe CPU usage as the malware masqueraded as a Java Full GC process.
After the initial mitigation proved insufficient, Qinglong maintainers released a later fix in PR #2941 that correctly addressed the authentication bypass logic. This was described as the effective remediation for the exploited vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026
Researchers reported an active campaign exploiting more than 1,000 internet-exposed **ComfyUI** instances, especially deployments running without authentication and those using unsafe custom nodes or **ComfyUI-Manager**, to gain unauthenticated remote code execution. The attackers used a purpose-built Python scanning pipeline to sweep cloud IP ranges, identify vulnerable systems, and deploy a payload known as **`ghost.sh`**, then monetized access by installing **XMRig** for Monero mining and **lolMiner** for Conflux mining while also enrolling compromised hosts into a **Hysteria v2** proxy botnet controlled through a Flask-based command-and-control panel. The operation showed extensive persistence and defense-evasion tradecraft, including fileless execution via **`memfd_create`**, process masquerading, an **`LD_PRELOAD`** rootkit for process hiding, watchdog-based restoration, scattered backups, and immutable file locking. Investigators also found reinfection mechanisms in newer scanner versions, including a fake **"GPU Performance Monitor"** custom node that re-downloads the payload every six hours and a poisoned default startup workflow that relaunches it whenever ComfyUI restarts. Infrastructure tied to **`77.110.96[.]200`** and additional SSH-linked hosts across China Mobile, DigitalOcean, and AWS suggests a broader opportunistic campaign that may overlap with activity targeting other exposed services such as Redis.
Jun 29, 2026
Check Point disclosed active exploitation of **CVE-2026-50751**, a critical authentication bypass in Check Point VPN Remote Access, Mobile Access, and Spark firewalls under specific configurations. The flaw, rated **CVSS 9.3**, affects systems using the deprecated **IKEv1** key exchange path and allows a remote, unauthenticated attacker to establish a VPN session without a valid password. Check Point said suspicious activity was detected on June 4, with the earliest known attacks dating to early May and a rise in activity across multiple jurisdictions in early June; customers were urged to review logs back to May 7 and investigate indicators of compromise. The company linked at least one confirmed post-compromise intrusion to a **Qilin ransomware** affiliate, describing a financially motivated attack that used VPS infrastructure and likely relied on **Rclone** for data exfiltration, with possible use of the **Tox** protocol for communications. Reporting also noted attempts to retrieve malicious **ELF** payloads from attacker-controlled infrastructure and warned that related infrastructure may also be probing VPN flaws in products from **Palo Alto, Fortinet, and F5**. Check Point released hotfixes for CVE-2026-50751 and for **CVE-2026-50752**, a separate flaw that could enable man-in-the-middle attacks on site-to-site tunnels but had not been observed as weaponized; the vendor advised organizations to apply fixes or disable IKEv1 where possible.
Aug 31, 2026