Hackers exploit RCE flaws in Qinglong task scheduler for cryptomining
Hackers exploit authentication bypass flaws in Qinglong task scheduler to deploy cryptominers.
Attackers have been exploiting two authentication bypass vulnerabilities (CVE-2026-3965 and CVE-2026-4047) in Qinglong, a popular open-source task scheduling tool, since early February 2026 to deploy cryptominers on developers' servers. The flaws stem from mismatches between Express.js routing behavior and security middleware assumptions, allowing unauthenticated access to protected admin endpoints. Attackers injected malicious shell commands to download and execute a hidden cryptominer process named '.fullgc' from an attacker-controlled domain.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Snyk?
Get an email when a new story names Snyk, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-3965
- cve — CVE-2026-4047
- domain — file.551911.xyz
- malware — .fullgc