[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fz3VnfG3oKESpgGGQoYJBTO6dkNTOm_ykwN3lSG3MOzM":3},{"article":4,"iocs":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":37},"42d901ca-6c60-4f4f-b1b2-4d7a2be3d24f","Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds","human-attacker-exploits-marimo-rce-reaches-ssh-bastion-in-eight-seconds-f78f80","With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access. In one instance highlighted by the cloud security company, the threat actor pivoted from a vulnerable Marimo notebook to an SSH","A highly skilled human attacker exploited a critical Marimo RCE vulnerability (CVE-2026-39987) and reached an SSH bastion host in just eight seconds, demonstrating that human expertise can still match or exceed AI-assisted attack speeds. The attacker used custom Python tools, bypassed security traps, and leveraged harvested AWS credentials to gain access, highlighting the continued threat posed by sophisticated manual operations.","Skilled human attacker exploits Marimo RCE vulnerability in eight seconds, bypassing AI-assisted attack speeds.","Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds Ravie LakshmananSep 15, 2026Vulnerability \u002F Malware With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access. In one instance highlighted by the cloud security company, the threat actor pivoted from a vulnerable Marimo notebook to an SSH bastion host in eight seconds using a custom Python toolkit they \"wrote and debugged by hand\" without any AI agent in the loop. \"Eight seconds is the kind of speed we expect to see in AI-assisted attacks,\" the Sysdig Threat Research Team said. \"This operator got there on skill alone, and along the way walked straight past a trap that every agentic threat actor (ATA) we've profiled against this same CVE fell into. Not only can skilled human attackers move at machine speed, but they can also often better evade defenders' detections.\" The attack chain has been found to exploit CVE-2026-39987 (CVSS score: 9.3), a pre-authenticated remote code execution vulnerability impacting all versions of Marimo that came under active exploitation within hours of public disclosure. Upon gaining an initial foothold, the threat actor is said to have run an end-to-end credential-pivot chain, leveraging the Marimo flaw to gain a full interactive shell, followed by an Amazon Web Services (AWS) Secrets Manager call using credentials harvested from the compromised instance, and SSH access to a bastion host with the retrieved private key - 18:57:22: Fresh WebSocket connection 18:57:26: Lookup against the application's stored credential returns the harvested AWS key 18:57:30: SSH authentication observed at the bastion host The entire activity lasted from 12:52 p.m., when the first WebSocket connection was made from \"172.236.12[.]17\" to the \"\u002Fterminal\u002Fws WebSocket endpoint exposed by Marimo, to 9:50 p.m., during which the threat actor deployed an asyncssh-style listener setup against an attacker-owned VPS. \"Over the course of a nine-hour session, they issued more than 850 interactive commands, used no recognizable publicly available offensive tooling, and hand-rolled their scripts in-session,\" Sysdig said. \"The operator's tradecraft converged on a single backgrounded Python3 invocation, not an agentic framework, that pulls the credential, fetches the SSH key from Secrets Manager, writes it to disk, and authenticates to the bastion over SSH in one shot.\" \"AI may be changing the economics of attacks — more targets, faster time-to-exploit, and less manual grind on repetitive tasks — but it has not yet replaced the skilled attacker who knows how to build from scratch and avoid traps.\" The findings come as Hunt.io disclosed details of a cryptomining campaign that has compromised 3,562 Redis servers likely following a broad internet sweep of candidate Redis hosts on port 6379, while simultaneously launching three parallel pipelines - WordPress target discovery, which scans a list of HTTPS hosts for WordPress version, installed plugins, and whether XML-RPC or directory listings are exposed AOF-based SSH authorized_keys injection, which uses Redis's append-only file (AOF) mode to perform authorized_keys SSH key injection Lua sandbox-escape probing, which runs Redis EVAL commands and sandbox escape attempts against three hosts (\"47.250.92[.]230,\" \"34.166.99[.]116,\" and \"20.198.10[.]42\") The primary exploitation method is the use of the SLAVEOF command to smuggle attacker-controlled content onto a target Redis server, resulting in the deployment of an XMRig miner. The activity, which came to light after the discovery of an exposed working environment at 188.245.99[.]156, has not been attributed to any known threat actor or group. \"Confirmed victims span Redis 2.8.17 (2015) through 7.2.0 (2023) and Linux from EOL RHEL\u002FCentOS 6 to current Ubuntu kernels, pointing to missing authentication as the weakness rather than a version-specific bug,\" Hunt.io said. \"The toolkit runs four techniques across three services, but only Redis rogue replication worked at scale: SSH key-injection and MongoDB sandbox-escape returned zero across 2,810 attempts, and a complete WordPress credential-to-webshell chain was recovered but not confirmed at scale.\" In recent months, a single operator was also linked to a massive campaign dubbed Operation CameraSwarm that compromised over 14,000 Dahua IP cameras using brute-force attacks, authentication bypass flaws (CVE-2021-33044 and CVE-2021-33045), and a peer-to-peer (P2P) relay technique. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Cloud security, cryptojacking, Malware, Vulnerability, Web Security ⚡ Top Stories This Week OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure Claude Used to Automate Exploitation and Data Theft Across Multiple Victims Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks When the Whole Company Adopts AI: What It Does to Your SOC Your Critical Vulnerabilities Might Not Be Your Biggest Risk What It Took to Reach 1 Billion Build Manifests US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries Why Are So Many Security Professionals Keeping Breaches Quiet? The Economics of Dwell Time and Why AI Native SIEM Changes the Equation ⭐ Featured Resources Get the eBook: Map Enterprise AI Risk Across the Full Lifecycle Give SOC Analysts Visibility Into 90% of Attacks Within 60 Seconds Benchmark Your SOC's AI Adoption With the 2026 Security Operations Report Register for LDR516: Strategic Vulnerability and Threat Management at SANS DC Metro","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fhuman-attacker-exploits-marimo-rce.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjzWVpv5OsfVGAYPz4or_uMgVNDXTSzyXpTB8XLtCFHdzk9IliH8Aydez_Zo9hDGSj7__A0cFwnjKUpRWn5nn4CSd5wlaIJ1-BpU29tUyeh3pC63H_kXIn9ANQna1FBENp-td6TCC6z50ZEcAeNjAZMA-tIA9_x9nYrlHqbnJOijQpbeHsQmW5tKMczy4ek\u002Fs1600\u002Fmarimo%20%281%29.jpg","2026-09-15T11:52:28+00:00","2026-09-15T14:00:26.422482+00:00",8,[18,21,23,26,28,30],{"name":19,"type":20},"Marimo","product",{"name":22,"type":20},"Redis",{"name":24,"type":25},"SSH","technology",{"name":27,"type":25},"AWS Secrets Manager",{"name":29,"type":25},"Python",{"name":31,"type":25},"AI","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56,60,64,67,69,71],{"type":57,"value":58,"context":59},"cve","CVE-2026-39987","Remote code execution vulnerability in Marimo",{"type":61,"value":62,"context":63},"ip","172.236.12[.]17","Source IP for initial WebSocket connection to Marimo",{"type":61,"value":65,"context":66},"47.250.92[.]230","IP involved in Redis Lua sandbox-escape probing",{"type":61,"value":68,"context":66},"34.166.99[.]116",{"type":61,"value":70,"context":66},"20.198.10[.]42",{"type":61,"value":72,"context":73},"188.245.99[.]156","Exposed working environment for cryptomining campaign"]