Attackers Weaponize CVE-2026-39987 to Spread Blockchain

Cybersecuritynews •Tushar Subhra Dutta • April 17, 2026

A critical vulnerability in the marimo Python notebook platform is now being actively used by attackers to deploy a blockchain-powered backdoor on developer systems. The flaw, tracked as CVE-2026-39987, allows remote code execution without authentication, making it a dangerous entry point for threat actors leveraging it to install a new variant of the NKAbuse malware […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Attackers Exploit CVE-2026-39987 to Deploy NKAbuse Malware via Hugging Face A critical vulnerability in the marimo Python notebook platform, tracked as CVE-2026-39987, has been actively exploited to deploy a new variant of NKAbuse malware. The flaw allows for remote code execution without authentication, enabling attackers to leverage Hugging Face Spaces for malware distribution. Exploitation began shortly after the vulnerability was disclosed on April 9, 2026, with attacks reported as early as April 11. Sysdig's research identified 11 unique IP addresses from 10 countries conducting 662 exploit events, including credential theft and lateral movement to PostgreSQL and Redis databases. The malware, which utilizes the NKN blockchain for command and control, poses a significant threat to developer environments. Attackers have employed various techniques, including typosquatting legitimate applications and using dropper scripts to install malware. The situation remains dynamic, with ongoing monitoring and evolving tactics observed among threat actors. 4 sources 73

Extracted Entities

Attackers Weaponize CVE-2026-39987 to Spread Blockchain

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)