Blue and white network illustrating cyber exploits, malware, and infrastructure defense.

Daily Cybersecurity News - April 10, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

April 10, 2026 3:58 PM 5 min read

Marimo Flaw Exploited Instantly

Critical

Executive Summary

A critical unauthenticated remote code execution vulnerability, identified as CVE-2026-39987, in the Marimo open-source Python notebook has been actively exploited in the wild. Attackers began leveraging the flaw less than 10 hours after its public disclosure, creating a working exploit directly from the advisory to steal credentials.

Vulnerability Details

Affected Product: Marimo versions up to and including 0.20.4
Identifier: CVE-2026-39987
CVSS Score: 9.3 (Critical)
Exploitation Status: Actively Exploited

Risk & Impact

Triage: Immediate patching is required due to active, trivial exploitation.
Attack Vector: An unauthenticated attacker can connect to the `/terminal/ws` WebSocket endpoint, which fails to validate authentication, to gain a full interactive shell and execute arbitrary system commands.
Ease of Exploit: Trivial. An attacker can gain a root shell with a single WebSocket connection, without needing any credentials or user interaction.

Action Plan

Immediate Action: Upgrade Marimo instances to version 0.23.0 or newer.
Detection: Monitor for connections to the `/terminal/ws` WebSocket endpoint. Sysdig has observed reconnaissance from 125 IP addresses and exploitation from a single IP.

Relevant professional terms

Unauthenticated Bug: A security flaw that can be exploited by an attacker without needing to provide any form of login credentials (e.g., username or password). This makes the vulnerability particularly dangerous as it can be leveraged by any remote attacker.
WebSocket: A communication protocol that provides full-duplex communication channels over a single TCP connection. In this case, the vulnerable WebSocket endpoint `/terminal/ws` allowed for a persistent, interactive shell.

Source: SecurityWeek

Researcher Leaks Windows Zero-Day

Executive Summary

A researcher has publicly released a proof-of-concept exploit for an unpatched zero-day vulnerability in Windows, dubbed BlueHammer. The exploit allows a local user to escalate privileges to the highest level (NT AUTHORITY\SYSTEM), but no CVE-ID has been assigned and the vulnerability remains unpatched.

Vulnerability Details

Affected Product: Windows 10, Windows 11, and Windows Server.
Exploitation Status: Proof-of-concept exploit is Publicly Available.

Risk & Impact

Triage: Urgent; requires immediate attention due to public exploit code and lack of a patch.
Attack Vector: The vulnerability is a local privilege escalation (LPE) that abuses the interaction between Microsoft Defender's update process, Volume Shadow Copy Service, and other legitimate Windows features. An attacker with low-level local access can exploit it to gain full SYSTEM-level control.
Ease of Exploit: A functional proof-of-concept is publicly available on GitHub, significantly lowering the barrier for attackers to weaponize it.

Action Plan

Immediate Action: Monitor official Microsoft channels for a security update.
Workaround: Enforce the principle of least privilege for all user accounts to limit the attack surface. Restrict local user permissions and monitor for unusual privilege escalation activity.
Detection: Hunt for anomalous behavior such as unexpected Volume Shadow Copy creation, unusual access to the Security Account Manager (SAM) database, and low-privileged accounts spawning SYSTEM-level processes.

Relevant professional terms

Zero-Day Vulnerability: A flaw in software that is unknown to the vendor and for which no official patch is available. The public release of an exploit for such a vulnerability creates a critical security risk.
Local Privilege Escalation (LPE): An attack where a threat actor who already has a foothold on a system with limited user permissions exploits a vulnerability to gain higher-level access, such as administrator or SYSTEM privileges.

Source: Dark Reading

CPUID Tools Hijacked To Spread Malware

Executive Summary

Attackers compromised a secondary API on the official CPUID website, modifying download links to distribute trojanized versions of popular utilities CPU-Z and HWMonitor. The multi-stage malware operated primarily in-memory to evade detection.

Attack Overview

Attack Path: A compromised API was used to poison download links on cpuid.com, redirecting users to malicious installers. The malware used DLL sideloading with a fake CRYPTBASE.dll to execute its initial payload.

Detection & Hunting

IOCs: Malicious C2 IPs included 104[.]21[.]63[.]112 and 172[.]67[.]145[.]101. Monitor for suspicious installers named 'HWiNFO_Monitor_Setup[.]exe'.

Strategic Takeaway

This incident highlights the critical risk of insecure APIs in software distribution channels, which can turn trusted update mechanisms into malware delivery vectors.

Relevant professional terms

Supply Chain Attack: A cyberattack that targets a less secure element, like a software vendor, to attack a primary target that uses its services.
DLL Sideloading: A technique where an attacker places a malicious DLL in a location where a legitimate application will load it instead of the intended one, enabling code execution.

Source: BleepingComputer

Iranian Hackers Target US Critical Infrastructure

Executive Summary

CyberAv3ngers, a threat group linked to Iran's Islamic Revolutionary Guard Corps (IRGC), is actively targeting U.S. critical infrastructure. The group exploits internet-exposed operational technology (OT), particularly Programmable Logic Controllers (PLCs), to cause operational disruption.

Key TTPs

Initial Access: Exploiting internet-exposed PLCs and using default or weak credentials to gain unauthorized access.
Execution: Deploying custom ladder logic files to manipulate device operations and defacing Human-Machine Interfaces (HMIs).

Campaign Analysis

The group has evolved from simple website defacements to deploying custom malware, indicating a significant increase in their capabilities. This shift demonstrates a direct threat to industrial control systems and critical operational technology environments.

Targeting & Infrastructure

Target Profile: U.S. critical infrastructure, including water and wastewater systems, energy, and manufacturing sectors.
Infrastructure: Primarily targets Israeli-made technology, specifically Unitronics and Rockwell Automation PLCs.

Relevant Terms

PLC (Programmable Logic Controller): An industrial computer used to automate manufacturing processes and control machinery in critical infrastructure.
IRGC (Islamic Revolutionary Guard Corps): A branch of the Iranian Armed Forces.

Source: Tenable

FBI Dismantles Russian Spy Router Network

Executive Summary

The FBI, through a court-authorized action known as "Operation Masquerade," has disrupted a global cyber-espionage campaign by neutralizing a botnet of compromised SOHO routers. This network was controlled by Russia's GRU (APT28) to steal sensitive data from military, government, and critical infrastructure targets.

The Scheme

TTP 1: Exploited known vulnerabilities in SOHO routers, particularly TP-Link models, to gain initial access.
TTP 2: Performed DNS hijacking by modifying router settings to redirect traffic through GRU-controlled servers.
TTP 3: Conducted adversary-in-the-middle (AitM) attacks to harvest credentials, authentication tokens, and other sensitive data.

The Players

Threat Actor: Russian GRU (APT28 / Fancy Bear)

The Consequence

Outcome: Court-authorized disruption of the botnet by remotely resetting DNS settings on compromised U.S.-based routers.

Strategic Takeaway

This operation demonstrates a proactive strategy to neutralize state-sponsored infrastructure directly, disrupting espionage campaigns at their core rather than solely pursuing attribution.

Relevant Terms

DNS Hijacking: A malicious technique that redirects queries to a domain name server, causing the user to navigate to a fraudulent site.
APT28: A cyber-espionage group linked to Russia's military intelligence agency, the GRU, also known as Fancy Bear or Forest Blizzard.

Source: CyberScoop