Daily Cybersecurity News – April 10, 2026
Marimo Flaw Exploited Instantly
CriticalExecutive Summary
A critical unauthenticated remote code execution vulnerability, identified as CVE-2026-39987, in the Marimo open-source Python notebook has been actively exploited in the wild.
Attackers began leveraging the flaw less than 10 hours after its public disclosure, creating a working exploit directly from the advisory to steal credentials.
Vulnerability Details
- Affected Product: Marimo versions up to and including 0.20.4
- Identifier: CVE-2026-39987
- CVSS Score: 9.3 (Critical)
- Exploitation Status: Actively Exploited
Risk & Impact
- Triage: Immediate patching is required due to active, trivial exploitation.
- Attack Vector: An unauthenticated attacker can connect to the `/terminal/ws` WebSocket endpoint, which fails to validate authentication, to gain a full interactive shell and execute arbitrary system commands.
- Ease of Exploit: Trivial. An attacker can gain a root shell with a single WebSocket connection, without needing any credentials or user interaction.
Action Plan
- Immediate Action: Upgrade Marimo instances to version 0.23.0 or newer.
- Detection: Monitor for connections to the `/terminal/ws` WebSocket endpoint. Sysdig has observed reconnaissance from 125 IP addresses and exploitation from a single IP.
Relevant professional terms
- Unauthenticated Bug
- A security flaw that can be exploited by an attacker without needing to provide any form of login credentials (e.g., username or password). This makes the vulnerability particularly dangerous as it can be leveraged by any remote attacker.
- WebSocket
- A communication protocol that provides full-duplex communication channels over a single TCP connection. In this case, the vulnerable WebSocket endpoint `/terminal/ws` allowed for a persistent, interactive shell.
Source: SecurityWeek
Researcher Leaks Windows Zero-Day
Executive Summary
A researcher has publicly released a proof-of-concept exploit for an unpatched zero-day vulnerability in Windows, dubbed BlueHammer. The exploit allows a local user to escalate privileges to the highest level (NT AUTHORITY\SYSTEM), but no CVE-ID has been assigned and the vulnerability remains unpatched.
Vulnerability Details
- Affected Product: Windows 10, Windows 11, and Windows Server.
- Exploitation Status: Proof-of-concept exploit is Publicly Available.
Risk & Impact
- Triage: Urgent; requires immediate attention due to public exploit code and lack of a patch.
- Attack Vector: The vulnerability is a local privilege escalation (LPE) that abuses the interaction between Microsoft Defender's update process, Volume Shadow Copy Service, and other legitimate Windows features. An attacker with low-level local access can exploit it to gain full SYSTEM-level control.
- Ease of Exploit: A functional proof-of-concept is publicly available on GitHub, significantly lowering the barrier for attackers to weaponize it.
Action Plan
- Immediate Action: Monitor official Microsoft channels for a security update.
- Workaround: Enforce the principle of least privilege for all user accounts to limit the attack surface. Restrict local user permissions and monitor for unusual privilege escalation activity.
- Detection: Hunt for anomalous behavior such as unexpected Volume Shadow Copy creation, unusual access to the Security Account Manager (SAM) database, and low-privileged accounts spawning SYSTEM-level processes.
Relevant professional terms
- Zero-Day Vulnerability
- A flaw in software that is unknown to the vendor and for which no official patch is available. The public release of an exploit for such a vulnerability creates a critical security risk.
- Local Privilege Escalation (LPE)
- An attack where a threat actor who already has a foothold on a system with limited user permissions exploits a vulnerability to gain higher-level access, such as administrator or SYSTEM privileges.
Source: Dark Reading
CPUID Tools Hijacked To Spread Malware
Executive Summary
Attackers compromised a secondary API on the official CPUID website, modifying download links to distribute trojanized versions of popular utilities CPU-Z and HWMonitor.
The multi-stage malware operated primarily in-memory to evade detection.
Attack Overview
- Attack Path: A compromised API was used to poison download links on cpuid.com, redirecting users to malicious installers. The malware used DLL sideloading with a fake CRYPTBASE.dll to execute its initial payload.
Detection & Hunting
- IOCs: Malicious C2 IPs included 104[.]21[.]63[.]112 and 172[.]67[.]145[.]101. Monitor for suspicious installers named 'HWiNFO_Monitor_Setup[.]exe'.
Strategic Takeaway
This incident highlights the critical risk of insecure APIs in software distribution channels, which can turn trusted update mechanisms into malware delivery vectors.
Relevant professional terms
- Supply Chain Attack
- A cyberattack that targets a less secure element, like a software vendor, to attack a primary target that uses its services.
- DLL Sideloading
- A technique where an attacker places a malicious DLL in a location where a legitimate application will load it instead of the intended one, enabling code execution.
Source: BleepingComputer
Iranian Hackers Target US Critical Infrastructure
Executive Summary
CyberAv3ngers, a threat group linked to Iran's Islamic Revolutionary Guard Corps (IRGC), is actively targeting U.S. critical infrastructure.
The group exploits internet-exposed operational technology (OT), particularly Programmable Logic Controllers (PLCs), to cause operational disruption.
Key TTPs
- Initial Access: Exploiting internet-exposed PLCs and using default or weak credentials to gain unauthorized access.
- Execution: Deploying custom ladder logic files to manipulate device operations and defacing Human-Machine Interfaces (HMIs).
Campaign Analysis
The group has evolved from simple website defacements to deploying custom malware, indicating a significant increase in their capabilities. This shift demonstrates a direct threat to industrial control systems and critical operational technology environments.
Targeting & Infrastructure
- Target Profile: U.S. critical infrastructure, including water and wastewater systems, energy, and manufacturing sectors.
- Infrastructure: Primarily targets Israeli-made technology, specifically Unitronics and Rockwell Automation PLCs.
Relevant Terms
- PLC (Programmable Logic Controller): An industrial computer used to automate manufacturing processes and control machinery in critical infrastructure.
- IRGC (Islamic Revolutionary Guard Corps): A branch of the Iranian Armed Forces.
Source: Tenable
FBI Dismantles Russian Spy Router Network
Executive Summary
The FBI, through a court-authorized action known as "Operation Masquerade," has disrupted a global cyber-espionage campaign by neutralizing a botnet of compromised SOHO routers.
This network was controlled by Russia's GRU (APT28) to steal sensitive data from military, government, and critical infrastructure targets.
The Scheme
- TTP 1: Exploited known vulnerabilities in SOHO routers, particularly TP-Link models, to gain initial access.
- TTP 2: Performed DNS hijacking by modifying router settings to redirect traffic through GRU-controlled servers.
- TTP 3: Conducted adversary-in-the-middle (AitM) attacks to harvest credentials, authentication tokens, and other sensitive data.
The Players
- Threat Actor: Russian GRU (APT28 / Fancy Bear)
The Consequence
- Outcome: Court-authorized disruption of the botnet by remotely resetting DNS settings on compromised U.S.-based routers.
Strategic Takeaway
This operation demonstrates a proactive strategy to neutralize state-sponsored infrastructure directly, disrupting espionage campaigns at their core rather than solely pursuing attribution.
Relevant Terms
- DNS Hijacking: A malicious technique that redirects queries to a domain name server, causing the user to navigate to a fraudulent site.
- APT28: A cyber-espionage group linked to Russia's military intelligence agency, the GRU, also known as Fancy Bear or Forest Blizzard.
Source: CyberScoop