⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More

Summary: The FBI disrupted infrastructure tied to a Chinese technical quartermaster group called QTYF, which built the QScan and QTRouter frameworks used to target U.S. critical infrastructure networks and is employed by Nanjing Xinjiuwei Network Technology Company. The week's patch list spans dozens of CVEs across TP-Link, Docker, Jenkins, Django, Palo Alto Networks GlobalProtect, Zscaler Client Connector, Google Chrome, Ubiquiti UniFi, and ServiceNow's AI Platform, among others.
What's compelling: The recap's own framing is that most of these attacks arrived through things already trusted - shipped devices, familiar prompts, support tools, valid access, and systems meant to protect the network - so a Chinese proxy framework built for espionage and a router that shipped ready to listen are the same problem wearing different clothes.

Read the original at The Hacker News ↗

Topics: OT / ICS & Critical Infrastructure
Mentions: CVE-2025-15628 CVE-2025-30237 CVE-2025-30241 CVE-2026-0251 CVE-2026-15307 CVE-2026-15337 CVE-2026-15830 CVE-2026-15920 CVE-2026-16348 CVE-2026-17106 CVE-2026-18431 CVE-2026-18885 CVE-2026-18886 CVE-2026-19516 CVE-2026-19598 CVE-2026-19874 CVE-2026-19912 CVE-2026-19913 CVE-2026-59565 CVE-2026-59567 CVE-2026-59568 CVE-2026-65643 CVE-2026-67618 CVE-2026-69251 CVE-2026-69253 CVE-2026-69254 CVE-2026-69255 CVE-2026-69256 CVE-2026-69259 CVE-2026-69264 CVE-2026-70426 CVE-2026-70470 CVE-2026-70477 CVE-2026-73484 CVE-2026-73485 CVE-2026-73486 CVE-2026-73487 CVE-2026-73554 CVE-2026-73601 CVE-2026-73602 CVE-2026-74820 CVE-2026-75149 CVE-2026-75604 CVE-2026-76639 CVE-2026-76640 CVE-2026-77537 CVE-2026-77550 CVE-2026-77554 CVE-2026-77775 CVE-2026-77776 CVE-2026-7791 CVE-2026-78541 CVE-2026-78935 CVE-2026-79012 CVE-2026-79052 CVE-2026-79054 CVE-2026-79121 CVE-2026-79150 CVE-2026-79200 CVE-2026-79224 CVE-2026-79282 CVE-2026-79290 CVE-2026-9254
Related: Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode Cyber Risks ·
Unpatched Kaltura mw Embed Flaws Could Let Remote Attackers Read Files and Run Code Cyber Risks ·
Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth Cyber Risks ·