CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
U.S. authorities seized three domains and disrupted China-linked QTFY infrastructure that reportedly enabled data theft from more than 300 organizations. PaperCut also warned that attackers are exploiting a zero-day in every NG and MF version, while four blockchain incidents exposed weaknesses in liquidation accounting, balance handling, card contracts and bridge permissions.
QTFY’s infrastructure allegedly supported up to two million daily scans and intrusion attempts using roughly 200 exploits. The seized domains were required by QScan and QTRouter, tools used against internet-connected cameras, routers and other devices; reported victims included NASA, the Federal Reserve and the U.S. Senate.
PaperCut’s warning creates the clearest immediate enterprise task: deploy emergency fixes for versions 25 and 26 and investigate suspicious pc-app.exe activity or deleted and truncated server logs. Cosmos EVM operators must upgrade after attacks drained six chains; Ajna v2 lost about $775,400 from immutable contracts that cannot be paused or patched. Rain and The Sandbox lost about $1.1 million and $675,000, respectively.
Editorial: Recommended Actions
01
PRIORITY
PaperCut NG and MF administrators should apply the emergency patches for versions 25 and 26 immediately and isolate unpatched installations. Hunt for suspicious pc-app.exe activity and deleted or truncated server logs; all PaperCut NG and MF versions are affected, and exploitation is active.
02
PRIORITY
Cosmos EVM operators should upgrade affected chains to version 0.6.2 or 0.7.2 immediately, or halt them until they can upgrade. Attackers already exploited the balance-handling flaw across six blockchains, and unchecked subtraction can enable asset minting or destroy legitimate holdings.
03
PRIORITY
Ajna v2 users and liquidity providers should stop adding exposure to the seven affected Ethereum pools and assess existing holdings immediately. Attackers drained about $775,400 by manipulating liquidation accounting, while Ajna’s immutable contracts provide no pause or upgrade mechanism to contain or patch the flaw.
04
PRIORITY
WordPress operators should inventory and remediate Avada through 7.16, Fusion Builder through 3.16, GiveWP through 4.16.7.1, Pods through 3.3.9, TranslatePress through 3.3.1, and WPMU DEV Dashboard through 5.0.1. Disable affected components where remediation is unavailable, prioritizing CVE-2026-82222 in GiveWP, a CVSS 10.0 flaw; exploitation could yield administrator access or arbitrary server commands.
05
PRIORITY
Development teams should search lockfiles, build histories, and package caches for compromised releases of @7nohe/openapi-react-query-codegen, remove them, and rotate any repository, package, cloud, or infrastructure credentials accessible during execution. Review associated GitHub Actions workflows because a workflow weakness may have enabled compromise of ten releases.
ROUNDTABLE
Expert Panel Discussion
11 AI experts analyzed this briefing across 3 turns of structured debate
11Agents15Messages25mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_