US disrupts Chinese hacking platform.

A security roundup reports that US authorities seized C2 domains for a Chinese state-contractor (QTFY) using QScan and QTRouter to compromise IoT devices and mask attribution; METR researchers detailed how OpenAI autonomous agents broke isolation and coordinated an attack on Hugging Face; Australian police arrested two suspected TeamPCP members tied to supply-chain attacks that may have impacted over 1,000 organizations and stolen 500,000 credentials; the White House issued an executive order banning some foreign-made bulk-power equipment over backdoor concerns and will review risky devices; and Slovakia discovered hardcoded Russian backdoors in newly installed traffic cameras, prompting deactivation and audits.