Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining

Snyk reports two authentication-bypass remote code execution (RCE) vulnerabilities in the Qinglong task scheduling panel (CVE-2026-3965, CVE-2026-4047) that have been actively exploited in the wild to deploy cryptomining malware. The incidents highlight risks to self-hosted CI/task-runner tooling: attackers bypass authentication, execute arbitrary tasks, and install miners. Operators should urgently patch or apply vendor mitigations, restrict network exposure, rotate credentials, audit scheduled tasks and logs for miner indicators, and implement monitoring and access controls for self-hosted管理