60
60
60
May 2026 CVE Landscape
60
60
60
Week in review: Microsoft patches exploited Windows CLFS 0-day, WinRAR MotW bypass flaw fixed
60
Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
Attacker exploited unauthenticated marimo WebSocket RCE CVE-2026-39987 to steal AWS credentials and SSH into a bastion host in eight seconds.
Sysdig Threat Research Team documented a real intrusion exploiting CVE-2026-39987 in marimo (versions up to 0.20.4, fixed in 0.23.0), where the unauthenticated /terminal/ws WebSocket endpoint exposed an interactive shell. Within eight seconds the attacker pulled AWS credentials from Redis, extracted an SSH private key from AWS Secrets Manager via Boto3, and authenticated to a bastion host; over nine hours the operator ran 850+ commands using a staged custom Python toolkit. Blocked EC2 Instance Connect attempts (SendSSHPublicKey to placeholder instance i-0000000000000000) provide a high-confidence detection signal.
72
60
60
60
60
New TETRA Radio Encryption Flaws Expose Law Enforcement Communications
60
60
60
60
60
60
60
60
60
Week in review: Microsoft fixes two exploited zero-days, SOC teams are losing trust in security tools
60
60
LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers
50
⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
60
AI-driven bug hunting fuels record Microsoft Patch Tuesday
60
60
60
60
60
57
60
60
60
50
60
60
60
60
60