The self-hosted payment processor disclosed an actively exploited vulnerability with user funds at risk, telling operators to move to version 2.4.2 immediately or take their servers fully offline until they can patch. The warning landed the same week the Coldcard exploit crossed nine figures, making it a rough stretch for two very different corners of the self-custody stack.