Loading story…
A critical pre-authentication remote code execution flaw in the Marimo open-source Python notebook platform was exploited in the wild less than 10 hours after disclosure, giving attackers an unauthenticated path to a full PTY shell through the /terminal/ws WebSocket endpoint. The vulnerability, tracked as GHSA-2679-6mx9-h9xc and later assigned CVE-2026-39987, affects Marimo versions 0.20.4 and earlier and carries a CVSS 9.3 severity rating. Marimo addressed the issue in version 0.23.0.
Sysdig said it observed the first exploitation attempt against a honeypot 9 hours and 41 minutes after the advisory was published, despite the absence of a public proof-of-concept at the time. The attacker reportedly validated the flaw, obtained interactive shell access, searched the filesystem for .env files and SSH keys, and accessed fake AWS credentials planted on the system; Sysdig also recorded 125 additional unique IP addresses conducting reconnaissance in the first 12 hours. Researchers said the activity appeared to involve a human operator and warned defenders to patch immediately, restrict exposure to /terminal/ws, rotate potentially exposed secrets, and monitor for suspicious WebSocket connections.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Between 2026-04-11 and 2026-04-14, Sysdig documented 662 exploit events in which attackers used CVE-2026-39987 to harvest credentials, attempt reverse shells, and move laterally into PostgreSQL and Redis. The most significant activity involved deployment of a previously undocumented NKAbuse malware variant hosted on a typosquatted HuggingFace Space and disguised as a Kubernetes tool named kagent.
During the first 12 hours after disclosure, Sysdig recorded one source IP performing actual exploitation and 125 additional unique IPs conducting reconnaissance. The activity showed rapid attacker interest in internet-facing Marimo instances immediately after the advisory became public.
After exploiting the flaw, the threat actor obtained an interactive shell, explored the filesystem, read a .env file containing fake AWS credentials and secrets, and searched for SSH keys. Sysdig described the activity as methodical and partly manual, with the operator returning later to recheck the target.
Sysdig observed the first exploitation attempt against a honeypot Marimo instance 9 hours and 41 minutes after disclosure on 2026-04-08. The attacker used advisory details to build an exploit despite there being no public proof-of-concept at the time.
Marimo addressed the vulnerability by releasing version 0.23.0. The update fixed the authentication bypass in the /terminal/ws endpoint that allowed attackers to obtain a shell and execute arbitrary commands.
On 2026-04-08, a critical remote code execution flaw affecting Marimo versions 0.20.4 and earlier was publicly disclosed. The issue involved the unauthenticated /terminal/ws WebSocket endpoint and was later tracked as GHSA-2679-6mx9-h9xc and CVE-2026-39987.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
resecurity.com
Open sourcebleepingcomputer.com
Open sourcesysdig.com
Open sourcewebflow.sysdig.com
Open sourcethehackernews.com
Open sourcesysdig.com
Open sourcewebflow.sysdig.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sysdig reported an intrusion in which a threat actor exploited **`CVE-2026-39987`** on an internet-exposed marimo notebook server and then used an **LLM agent** to carry out post-compromise actions. The attacker harvested AWS credentials, retrieved an SSH private key from **AWS Secrets Manager**, pivoted through a bastion host, and exfiltrated an internal **PostgreSQL** database in under an hour. Sysdig said the activity appeared agent-driven because commands were generated dynamically from live output, included machine-oriented formatting, and showed evidence of real-time adaptation rather than a fixed script. The operation also used distributed infrastructure, including **Cloudflare Workers**, to spread AWS API calls and SSH sessions across multiple source IPs, reducing the effectiveness of IP-based correlation. The incident adds to broader evidence that attackers are operationalizing language models in intrusions: Splunk previously analyzed **LAMEHUG**, a Windows malware family that uses a Hugging Face-hosted **Qwen 2.5-Coder-32B-Instruct** model to generate malicious commands for reconnaissance, file theft, and exfiltration over SSH or HTTPS. Defenders were urged to upgrade marimo to **0.23.0 or later**, restrict or disable the **`/terminal/ws`** endpoint if patching is not possible, rotate exposed credentials and keys, and prioritize behavior-based detection over static signatures.
Jun 29, 2026
CISA updated its Known Exploited Vulnerabilities catalog to add three vulnerabilities now tracked as actively exploited: **CVE-2026-39987** in Marimo, **CVE-2024-1708** in ConnectWise ScreenConnect, and **CVE-2026-32202** in Microsoft Windows. The Marimo issue was added in a catalog update that raised the total count to 1,579 entries, while a later update increased the catalog to 1,585 entries and included the ScreenConnect and Windows flaws. CISA described **CVE-2026-39987** as an unauthenticated remote code execution vulnerability that can provide shell access and allow arbitrary system command execution before authorization, mapped to `CWE-306`. **CVE-2024-1708** was listed as a ScreenConnect path traversal flaw that could enable remote code execution or directly affect confidential data and critical systems, and **CVE-2026-32202** was identified as a Windows Shell protection mechanism failure that allows network spoofing by an unauthorized attacker. CISA directed organizations to apply vendor mitigations, follow **BOD 22-01** guidance for cloud services, or discontinue use if mitigations are unavailable; remediation deadlines were set for **2026-05-07** for Marimo and **2026-05-12** for the ScreenConnect and Windows entries.
Jun 29, 2026
SolarWinds warned that multiple vulnerabilities in **Web Help Desk** are being actively exploited, with reporting highlighting a critical flaw that can lead to **remote code execution** on exposed help-desk servers. Public references tie the activity to `CVE-2025-40554`, while additional SolarWinds advisories and third-party research point to related issues including `CVE-2025-40552`, `CVE-2025-40553`, and `CVE-2025-40536`, indicating a broader security problem affecting the product. Security researchers and defenders published proof-of-concept material and detection guidance shortly after disclosure, including a watchTowr repository focused on Web Help Desk exploitation and a GitHub Gist describing **uncommon process activity** associated with compromise. The combination of vendor advisories, media reporting, and public exploit research indicates that attackers moved quickly to weaponize the flaws, increasing risk for organizations that have not patched, isolated, or monitored SolarWinds Web Help Desk deployments.
Jul 4, 2026