News Summary

• Sysdig: A threat actor pivoted from a vulnerable Marimo notebook to an SSH bastion host in eight seconds using a custom Python toolkit they "wrote and debugged by hand" The attack chain has been found to exploit CVE-2026-39987 (CVSS score: 9.3), a pre-authenticated remote code execution vulnerability impacting all versions of Marimo.
• The findings come as Hunt.io disclosed details of a cryptomining campaign that has compromised 3,562 Redis servers.