A human operator moved from a vulnerable Marimo notebook to an SSH bastion host in eight seconds using a Python toolkit written and debugged by hand, according to cloud security company Sysdig.

The Sysdig Threat Research Team said that pace is what it expects from AI-assisted attacks, but the operator reached it on skill alone and avoided a trap that every agentic threat actor profiled against the same CVE had fallen into.

The chain exploited CVE-2026-39987, a pre-authenticated remote code execution flaw with a CVSS score of 9.3 affecting all Marimo versions, which saw active exploitation within hours of disclosure.

After gaining a shell, the attacker called AWS Secrets Manager with credentials harvested from the instance and used the retrieved private key to reach the bastion. A WebSocket connection at 18:57:22 was followed by a credential lookup at 18:57:26 and SSH authentication at 18:57:30.

The session began at 12:52 p.m. from 172.236.12[.]17 against Marimo's /terminal/ws endpoint and ended at 9:50 p.m. Over nine hours, the operator issued more than 850 interactive commands, used no recognizable public offensive tooling, and hand-rolled scripts in-session, converging on a single backgrounded Python3 invocation.

Separately, Hunt.io detailed a cryptomining campaign that compromised 3,562 Redis servers, likely after a broad sweep of port 6379, running three parallel pipelines. The main method smuggled attacker content via the SLAVEOF command to deploy an XMRig miner. Victims spanned Redis 2.8.17 through 7.2.0. The activity has not been attributed to any known group.

Source: The Hackers News