Isometric network nodes patching Adobe, Marimo, and CPUID vulnerabilities.

Daily Cybersecurity News - April 12, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

April 12, 2026 4:59 PM 4 min read

Adobe Patches Exploited Reader Zero-Day

High

Executive Summary

Adobe has released emergency security updates to address a critical zero-day vulnerability, identified as CVE-2026-34621, in its Acrobat and Reader products. The flaw has been actively exploited in the wild for months, allowing attackers to achieve arbitrary code execution on affected systems.

Vulnerability Details

Affected Product: Adobe Acrobat DC / Reader DC (versions 26.001.21367 and earlier) and Acrobat 2024 (versions 24.001.30356 and earlier) for Windows and macOS.
Identifier: CVE-2026-34621
CVSS Score: 8.6 (High)
Exploitation Status: Actively Exploited

Risk & Impact

Triage: Immediate patching is required. Adobe has assigned this update a priority rating of 1.
Attack Vector: The vulnerability is exploited when a user opens a specially crafted, malicious PDF file. This action can trigger a 'Prototype Pollution' flaw, leading to arbitrary code execution without further user interaction.
Ease of Exploit: Low. The attack requires no special privileges and has low complexity, making it an easy target for attackers once a user is convinced to open the malicious file.

Action Plan

Immediate Action: Update affected products to the patched versions: Acrobat DC / Reader DC version 26.001.21411, Acrobat 2024 for Windows to 24.001.30362, and Acrobat 2024 for macOS to 24.001.30360.
Workaround: Implement user awareness training to caution against opening unsolicited or untrusted PDF files. Application whitelisting and restricting file downloads can also serve as mitigating controls.
Detection: Indicators of Compromise (IOCs) have been released to help defenders detect potential exploitation. Observed attacks have utilized malicious PDFs with Russian-language lures related to the oil and gas industry.

Relevant professional terms

Zero-Day: A vulnerability in a system or device that has been disclosed but is not yet patched. Attackers can exploit these flaws before developers have a chance to release a fix.
Prototype Pollution: A JavaScript vulnerability that allows an attacker to modify an object's prototype, which can lead to the manipulation of an application's objects and properties, potentially resulting in arbitrary code execution.

Source: SecurityWeek

Marimo Flaw Enables Remote Code Execution

Critical

Executive Summary

A critical pre-authentication remote code execution vulnerability, identified as CVE-2026-39987, is under active exploitation in the wild. The flaw allows unauthenticated attackers to gain a full interactive shell on exposed Marimo instances, leading to arbitrary command execution and credential theft.

Vulnerability Details

Affected Product: Marimo (Python notebook) versions up to and including 0.20.4
Identifier: CVE-2026-39987
CVSS Score: 9.3 (Critical)
Exploitation Status: Actively Exploited

Risk & Impact

Triage: Immediate action required due to active, widespread exploitation.
Attack Vector: An unauthenticated attacker can connect to the `/terminal/ws` WebSocket endpoint, which fails to validate authentication, to gain an interactive shell.
Ease of Exploit: Trivial; requires only a standard WebSocket client, with attackers successfully building exploits directly from the advisory.

Action Plan

Immediate Action: Upgrade Marimo instances to version 0.23.0 or later.
Workaround: If upgrading is not immediately possible, restrict network access to the `/terminal/ws` endpoint using firewall rules or disable the terminal feature.
Detection: Monitor for connections to the `/terminal/ws` WebSocket endpoint. Attackers have been observed performing reconnaissance, searching for SSH keys, and attempting to exfiltrate data from `.env` files.

Relevant professional terms

Remote Code Execution (RCE): A class of software vulnerability that allows a malicious actor to execute arbitrary commands or code on a remote target machine, often leading to full system compromise.
Pre-authentication: Describes a vulnerability that can be exploited by an attacker without needing to log in or provide any valid credentials, making it accessible to any remote attacker.

Source: BleepingComputer

CPUID Website Compromise Delivers Malware

Executive Summary

For less than 24 hours, the official CPUID website was compromised by unknown threat actors who replaced download links for popular utilities like CPU-Z and HWMonitor. Users were served trojanized installers that deployed the STX Remote Access Trojan (RAT), a malware with information-stealing capabilities.

Attack Overview

Attack Path: Attackers compromised a secondary API on the cpuid[.]com website, allowing them to hijack download links and redirect users to malicious domains hosting the malware. The malware used DLL side-loading with a malicious 'CRYPTBASE[.]dll' to execute.
Attacker: The threat actors remain unknown, but they reused command-and-control infrastructure from a previous campaign that distributed malware via a fake FileZilla website.

Impact Assessment

Data Stolen: The STX RAT payload is designed to steal browser credentials and data from cryptocurrency wallets.

Detection & Hunting

IOCs: Malicious domains included: cahayailmukreatif.web[.]id, pub-45c2577dbd174292a02137c18e7b1b5a.r2[.]dev, transitopalermo[.]com, and vatrobran[.]hr. The C2 server was identified as welcome[.]supp0v3[.]com.

Strategic Takeaway

This incident underscores the critical risk of supply chain attacks, where compromising a trusted software vendor's distribution channel can rapidly infect a large user base.

Relevant professional terms

Remote Access Trojan (RAT): A type of malware that provides an attacker with covert remote administrative control over a compromised computer system.
DLL Side-Loading: An attack technique where a legitimate application is tricked into loading a malicious Dynamic-Link Library (DLL) file, allowing the malware to execute under the trusted application's process.

Source: The Hacker News