Qinglong Task Scheduler RCE Vulnerabilities Exploited in the Wild

**Executive summary:** In early 2026, attackers actively exploited two authentication-bypass vulnerabilities in the popular Qinglong task scheduler to gain unauthenticated remote code execution and deploy a concealed cryptominer (fullgc), driving CPU usage to 100% on affected Docker and VPS deployments; maintainers patched the flaws and advised operators to update containers, audit for malicious files, and restrict panel access behind VPNs.